# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=914 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 915 --- ## [String to Date while loading data from csv file to elasticsearch using logstash](https://discuss.elastic.co/t/string-to-date-while-loading-data-from-csv-file-to-elasticsearch-using-logstash/99479)
**Author:** [@devil\_srj7](https://discuss.elastic.co/u/devil_srj7)\ **Replies:** 4\ **Last updated:** [September 6, 2017, 6:53am UTC](https://discuss.elastic.co/t/string-to-date-while-loading-data-from-csv-file-to-elasticsearch-using-logstash/99479 "2017-09-06T06:53:41Z")
I’m using the apple stock as sample data. Here I have Date field which is being changed to string type when loading the data. the format of date in csv file is “dd-MM-YYY” I want to load this Date as a ‘date type’ to … --- ## [Sending Logstash's logs to /home/wangyufeng/logstash-5.5.2/logs which is now configured via log4j2.properties ERROR: No configuration file was specified. Perhaps you forgot to provide the '-f yourlogstash.conf' flag?](https://discuss.elastic.co/t/sending-logstashs-logs-to-home-wangyufeng-logstash-5-5-2-logs-which-is-now-configured-via-log4j2-properties-error-no-configuration-file-was-specified-perhaps-you-forgot-to-provide-the-f-yourlogstash-conf-flag/99503)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 4\ **Last updated:** [September 6, 2017, 4:15am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-home-wangyufeng-logstash-5-5-2-logs-which-is-now-configured-via-log4j2-properties-error-no-configuration-file-was-specified-perhaps-you-forgot-to-provide-the-f-yourlogstash-conf-flag/99503 "2017-09-06T04:15:06Z")
Elasticsearch version: 5.5.2 OS: Linux Logstash: 5.5.2 When I use the command “./logstash” ro start logstash, it throws such a expception: SZX1000355659:/home/wangyufeng/logstash-5.5.2/bin # ./logstash ERROR StatusL… --- ## [Cannot create pipeline {:reason=\>"Illegal character in scheme name at index 0: 10.62.179.32: 9200"}](https://discuss.elastic.co/t/cannot-create-pipeline-reason-illegal-character-in-scheme-name-at-index-0-10-62-179-32-9200/99507)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 4\ **Last updated:** [September 6, 2017, 3:53am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-reason-illegal-character-in-scheme-name-at-index-0-10-62-179-32-9200/99507 "2017-09-06T03:53:32Z")
Elasticsearch version: 5.5.2 Logstash version: 5.5.2 OS: Linux When I run the command “bin/logstash -f hello.conf”, I got a problem like this: ERROR StatusLogger No log4j2 configuration file found. Using default conf… --- ## [ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console](https://discuss.elastic.co/t/error-statuslogger-no-log4j2-configuration-file-found-using-default-configuration-logging-only-errors-to-the-console/98672)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 6\ **Last updated:** [September 6, 2017, 2:38am UTC](https://discuss.elastic.co/t/error-statuslogger-no-log4j2-configuration-file-found-using-default-configuration-logging-only-errors-to-the-console/98672 "2017-09-06T02:38:13Z")
Logstash version : 5.5.2 Elasticsearch version:5.5.2 When I use the command line(bin/logstash -f /etc/logstash/hello\_es.conf), it throws a such error: ERROR StatusLogger No log4j2 configuration file found. Using defau… --- ## [Query about Fingerprinting plugin - What exactly does it include when source is set to one field?](https://discuss.elastic.co/t/query-about-fingerprinting-plugin-what-exactly-does-it-include-when-source-is-set-to-one-field/99169)
**Author:** [@TheZeke](https://discuss.elastic.co/u/TheZeke)\ **Replies:** 0\ **Last updated:** [September 1, 2017, 9:26pm UTC](https://discuss.elastic.co/t/query-about-fingerprinting-plugin-what-exactly-does-it-include-when-source-is-set-to-one-field/99169 "2017-09-01T21:26:04Z")
What else is in the data variable within anonymize\_openssl(data) that might be included in the hex digest that I’m not including in my PHP in order to make it generate the same fingerprint that logstash does? Does it in… --- ## [Logstash is not filtering snort](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159)
**Author:** [@kanan930](https://discuss.elastic.co/u/kanan930)\ **Replies:** 3\ **Last updated:** [September 5, 2017, 7:21pm UTC](https://discuss.elastic.co/t/logstash-is-not-filtering-snort/99159 "2017-09-05T19:21:35Z")
Hi all, I am trying to filter snort alerts. I need to display the output on kibana dashboard. I have created the filtering script “logstash\_snort.conf” in /opt/bitnami/logstash/conf directory. logstash is running fine, … --- ## [Alter vs Translate vs If/Else statements](https://discuss.elastic.co/t/alter-vs-translate-vs-if-else-statements/98466)
**Author:** [@neu5ron](https://discuss.elastic.co/u/neu5ron)\ **Replies:** 1\ **Last updated:** [September 5, 2017, 5:47pm UTC](https://discuss.elastic.co/t/alter-vs-translate-vs-if-else-statements/98466 "2017-09-05T17:47:01Z")
I am trying to determine what is the fastest/most-efficient/recommendation (I was thinking of either using Translate, Alter, or just If/Else statements) for performing actions on data such as the following. $field has … --- ## [Xpath pattern not working](https://discuss.elastic.co/t/xpath-pattern-not-working/99457)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 0\ **Last updated:** [September 5, 2017, 3:17pm UTC](https://discuss.elastic.co/t/xpath-pattern-not-working/99457 "2017-09-05T15:17:05Z")
I am trying to parse SOAP messages using an XML filter. A SOAP message looks like this (all on one line) \ \\ **Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 13\ **Last updated:** [September 5, 2017, 2:49pm UTC](https://discuss.elastic.co/t/logstash-message-parsing/98970 "2017-09-05T14:49:41Z") Hi - I have the message in the below format, I couldn’t able to filter it and convert it to JSON or XML. I’d want to convert this to Key =\> Value pair of (Name =\> Value) and store it in ELK. Could someone please let m… --- ## [Noob question](https://discuss.elastic.co/t/noob-question/99093)
**Author:** [@Eliwe](https://discuss.elastic.co/u/Eliwe)\ **Replies:** 2\ **Last updated:** [September 5, 2017, 1:38pm UTC](https://discuss.elastic.co/t/noob-question/99093 "2017-09-05T13:38:03Z")
Hello, i new to logstash i wrestingling abit with getting json input that i want to send to http output. My Json looks like this: { "Space" =\> { "SpaceId" =\> "4510" }, "HttpRequest" =\> { … --- ## ["Could not fetch URL" while using http output plugin](https://discuss.elastic.co/t/could-not-fetch-url-while-using-http-output-plugin/98414)
**Author:** [@rajesh](https://discuss.elastic.co/u/rajesh)\ **Replies:** 4\ **Last updated:** [September 5, 2017, 1:21pm UTC](https://discuss.elastic.co/t/could-not-fetch-url-while-using-http-output-plugin/98414 "2017-09-05T13:21:22Z")
Hi… I am using http output plugin in logstash and the error am getting is, ERROR logstash.outputs.http - \[HTTP Output Failure\] Could not fetch URL {:url=\>"http://xxx.xx.xx:xxx" name=memoryStats.numBytesAllocated origi… --- ## [Install Logstash Plugin in sebp/elk for Docker](https://discuss.elastic.co/t/install-logstash-plugin-in-sebp-elk-for-docker/99414)
**Author:** [@Sharivari](https://discuss.elastic.co/u/Sharivari)\ **Replies:** 0\ **Last updated:** [September 5, 2017, 11:54am UTC](https://discuss.elastic.co/t/install-logstash-plugin-in-sebp-elk-for-docker/99414 "2017-09-05T11:54:01Z")
Hi there, I’m using ELK (sebp/elk) for Docker on Windows, so im using the virtual machine. Inside the VM i am installing elk via: sudo docker pull sebp/elk and $ sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:504… --- ## [Persistent Queue, no data lost regardless settings?](https://discuss.elastic.co/t/persistent-queue-no-data-lost-regardless-settings/98261)
**Author:** [@amiguez](https://discuss.elastic.co/u/amiguez)\ **Replies:** 2\ **Last updated:** [September 5, 2017, 10:20am UTC](https://discuss.elastic.co/t/persistent-queue-no-data-lost-regardless-settings/98261 "2017-09-05T10:20:25Z")
Hi there! reading the blog's post about persistent queue This section is not clear for me. Application / process level crash / interrupted shutdown. This is the most common cause of potential data loss that PQ helps … --- ## [Multiple grok filter](https://discuss.elastic.co/t/multiple-grok-filter/99284)
**Author:** [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\ **Replies:** 15\ **Last updated:** [September 5, 2017, 8:57am UTC](https://discuss.elastic.co/t/multiple-grok-filter/99284 "2017-09-05T08:57:38Z")
Hi, I have a log file that can contains these 2 type of line : \> 2017-06-28 14:23:04 W Failed to send file to URL \[http://some.URL.tv/server/some\_tag.m3u8\] after \[2\] attempts, retrying. \> 2017-06-27 10:40:34 I Dmx\[24… --- ## [How to run multiple configuration file as a service](https://discuss.elastic.co/t/how-to-run-multiple-configuration-file-as-a-service/99331)
**Author:** [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Replies:** 3\ **Last updated:** [September 5, 2017, 7:47am UTC](https://discuss.elastic.co/t/how-to-run-multiple-configuration-file-as-a-service/99331 "2017-09-05T07:47:00Z")
Hi All, I’m using Logstash 5.5.2. I have installed logstash using rpm. I’m trying to run multiple conf file logstash-a.conf, logstash-b.conf, logstash-c.conf parallely in logstash as a service. I have kept all conf fil… --- ## [Error when installing x-pack on logstash beta2](https://discuss.elastic.co/t/error-when-installing-x-pack-on-logstash-beta2/99108)
**Author:** [@MartinBr](https://discuss.elastic.co/u/MartinBr)\ **Replies:** 2\ **Last updated:** [September 5, 2017, 6:25am UTC](https://discuss.elastic.co/t/error-when-installing-x-pack-on-logstash-beta2/99108 "2017-09-05T06:25:50Z")
Hello, While trying to install x-pack on logstash beta2 (https://www.elastic.co/guide/en/logstash/6.0/installing-xpack-log.html), I encounter the following error : ERROR: Something went wrong when installing file:E:/Be… --- ## [Logstash docker image keeps resetting elasticsearch URL](https://discuss.elastic.co/t/logstash-docker-image-keeps-resetting-elasticsearch-url/99229)
**Author:** [@sfchrisgleason](https://discuss.elastic.co/u/sfchrisgleason)\ **Replies:** 6\ **Last updated:** [September 4, 2017, 7:49pm UTC](https://discuss.elastic.co/t/logstash-docker-image-keeps-resetting-elasticsearch-url/99229 "2017-09-04T19:49:42Z")
Hello all, I am experimenting with bringing up an ELK stack across multiple physical machines using the docker images (Docker running independently on each machine). I'm using the official images from elastic using: do… --- ## [Is Logstash 5.5 compatible with Java 1.7?](https://discuss.elastic.co/t/is-logstash-5-5-compatible-with-java-1-7/99198)
**Author:** [@rajesh](https://discuss.elastic.co/u/rajesh)\ **Replies:** 5\ **Last updated:** [September 4, 2017, 4:07pm UTC](https://discuss.elastic.co/t/is-logstash-5-5-compatible-with-java-1-7/99198 "2017-09-04T16:07:02Z")
Hi, I am trying to install Logstash 5.5 on a Linux machine which has Java 1.7. I have gone through some documentation and it says Logstash 5.5 is compatible with Java 1.7. Some say it’s not compatible. Can someone pleas… --- ## [Data not coming in to Logstash](https://discuss.elastic.co/t/data-not-coming-in-to-logstash/99272)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 3:48pm UTC](https://discuss.elastic.co/t/data-not-coming-in-to-logstash/99272 "2017-09-04T15:48:21Z")
Hi, Have tried both winlogbeat and filebeat, get same problem. I have configured an ELK-server that works just fine locally, now i am trying to send events from a remote server with winlogbeat or filebeat and the event… --- ## [Question about winlogbeat/Logstash](https://discuss.elastic.co/t/question-about-winlogbeat-logstash/99322)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 0\ **Last updated:** [September 4, 2017, 2:49pm UTC](https://discuss.elastic.co/t/question-about-winlogbeat-logstash/99322 "2017-09-04T14:49:17Z")
Hi, If i Point to a winlog that have about 1,5 million entries with winlogbeat, do i see the events in kibana as they arrive or do they appear in chunks. Because i Point to a winlog provider called Microsoft-Windows-Ba… --- ## [Group Logstash servers](https://discuss.elastic.co/t/group-logstash-servers/99317)
**Author:** [@AlexW](https://discuss.elastic.co/u/AlexW)\ **Replies:** 0\ **Last updated:** [September 4, 2017, 2:27pm UTC](https://discuss.elastic.co/t/group-logstash-servers/99317 "2017-09-04T14:27:25Z")
Hi! We are using X-Pack for monitoring our environment. Our environment is a logging pipeline. We have: 1 loadbalancer 2 shippers (Logstash) 3 indexers (Kafka and Logstash) 3 to n Elasticsearch nodes In Kibana on … --- ## [Ruby Filter Logstash](https://discuss.elastic.co/t/ruby-filter-logstash/99291)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 2:12pm UTC](https://discuss.elastic.co/t/ruby-filter-logstash/99291 "2017-09-04T14:12:15Z")
Hi - We are having the a field (xml.Terminal) in Elastic Search as: { “Value”: \[ { “DimSize”: \[ “45” \], “Value”: \[ “WindGen—git# THS209.x.x.x—C:\\git\\THS\_Modules\\Source\\Modules\\Simulation\\Simulation - WindGenerat… --- ## [Getting @timestamp value in Server's timezone, not UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 1:12pm UTC](https://discuss.elastic.co/t/getting-timestamp-value-in-servers-timezone-not-utc/99295 "2017-09-04T13:12:07Z")
Hi, My log-line looks like: 12.170.89.115 \[22/Aug/2017:00:08:11 -0400\] “GET /home.html HTTP/1.1” 200 714 13818 - (-) “-” “Java/1.5.0” And the grok filter is: grok { match =\> { “message” =\> ‘%{IPORHOST:clientip} \[%{… --- ## [How to set \`input-jdbc\` statement let it can set variables？](https://discuss.elastic.co/t/how-to-set-input-jdbc-statement-let-it-can-set-variables/98825)
**Author:** [@Moln](https://discuss.elastic.co/u/Moln)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 12:22pm UTC](https://discuss.elastic.co/t/how-to-set-input-jdbc-statement-let-it-can-set-variables/98825 "2017-09-04T12:22:59Z")
How to set input-jdbc statement let it can set variables？ e.g.: input { jdbc { #... jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" statement =\> "select \* from table\_name\_%{+yyyyMM}" #... } } Or is th… --- ## [Logstash can't start afer upgrading VM](https://discuss.elastic.co/t/logstash-cant-start-afer-upgrading-vm/98679)
**Author:** [@yami](https://discuss.elastic.co/u/yami)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 12:12pm UTC](https://discuss.elastic.co/t/logstash-cant-start-afer-upgrading-vm/98679 "2017-09-04T12:12:18Z")
Before it worked fine, then VM was added a more processors and this occurs \[root@localhost logstash\]# bin/logstash -f centralLogstash.conf --quiet --path.data usr/share/logstash/tmp Invalid file name for use with -Xl… --- ## [Join 3 tables with SQL in order to index with ES using Logstash](https://discuss.elastic.co/t/join-3-tables-with-sql-in-order-to-index-with-es-using-logstash/99129)
**Author:** [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Replies:** 2\ **Last updated:** [September 4, 2017, 11:34am UTC](https://discuss.elastic.co/t/join-3-tables-with-sql-in-order-to-index-with-es-using-logstash/99129 "2017-09-04T11:34:57Z")
I have 3 tables which I would like to index with ES using Logstash. My table structure looks like this: Table A: ID | Name ----- | ------ 28254 | Abc 28234 | Cdf 5228 | ztr 4195 | Gre 5220 | tds 5224 | cbc Table… --- ## [DNS Sink hole logstash config file filter](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 3\ **Last updated:** [September 4, 2017, 11:18am UTC](https://discuss.elastic.co/t/dns-sink-hole-logstash-config-file-filter/99222 "2017-09-04T11:18:46Z")
Hi Guys, I have pfsense 2.3 and have configured DNS resolver or sinkhole on the same. In short I have zone files which when query is matched that request will be sinkholed. This procedure is absolutely fine now I need t… --- ## [JSON file input to logstash not working](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 10:59am UTC](https://discuss.elastic.co/t/json-file-input-to-logstash-not-working/98651 "2017-09-04T10:59:09Z")
I am using json input to logstash and my output is Elasticsearch. Below is my input json file. \[ { color: "red", value: "#f00" }, { color: "green", value: "#0f0" }, { color: "blue", value: "#00f" }, { co… --- ## [Unable to install logstash-filter-elapsed plugin on Logstash 5.5.1](https://discuss.elastic.co/t/unable-to-install-logstash-filter-elapsed-plugin-on-logstash-5-5-1/99260)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 10:41am UTC](https://discuss.elastic.co/t/unable-to-install-logstash-filter-elapsed-plugin-on-logstash-5-5-1/99260 "2017-09-04T10:41:38Z")
Hi All, I’m trying to add the logstash-filter-elapsed plugin to my Logstash 5.5.1 installation and am seeing the following error during the installation process. This was running on a Windows server without any interven… --- ## [Adding a "\\n" in front of a line](https://discuss.elastic.co/t/adding-a-n-in-front-of-a-line/98647)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 1\ **Last updated:** [September 4, 2017, 9:56am UTC](https://discuss.elastic.co/t/adding-a-n-in-front-of-a-line/98647 "2017-09-04T09:56:53Z")
assuming I have a field “field1” with value “Hello world” How can I make the value become “\\nHello world” When I gsub it will always become “\\n"HelloWorld” [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=913) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=915)