# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=916 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 917 --- ## [Error starting logstash](https://discuss.elastic.co/t/error-starting-logstash/99066)
**Author:** [@elk\_of\_the\_forest](https://discuss.elastic.co/u/elk_of_the_forest)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 12:47am UTC](https://discuss.elastic.co/t/error-starting-logstash/99066 "2017-09-01T00:47:25Z")
Im using this command to start logstash: $ bin/logstash -f logstash-config/02-beats-input.conf -f logstash-config/10-syslog-filter.conf -f logstash-config/30-elasticsearch-output.conf Logstash gives this error. NameEr… --- ## [Logstash does not open a socket to elastic search](https://discuss.elastic.co/t/logstash-does-not-open-a-socket-to-elastic-search/98758)
**Author:** [@denzuko](https://discuss.elastic.co/u/denzuko)\ **Replies:** 3\ **Last updated:** [August 31, 2017, 8:53pm UTC](https://discuss.elastic.co/t/logstash-does-not-open-a-socket-to-elastic-search/98758 "2017-08-31T20:53:16Z")
Hi guys, I’ve been butting heads with setting up my ELK stack inside docker. At this point I’ve traced the point of fault down to logstash and currently believe it is either the pipeline or something simple that one wit… --- ## [Logstash connection to elasticsearch](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768)
**Author:** [@rogerscuall](https://discuss.elastic.co/u/rogerscuall)\ **Replies:** 7\ **Last updated:** [August 31, 2017, 7:49pm UTC](https://discuss.elastic.co/t/logstash-connection-to-elasticsearch/98768 "2017-08-31T19:49:04Z")
I'm using the official docker containers for elasticsearch and logstash and following for the most part the configuration in this website, but I'm having problem with logstash connecting to elasticsearch. The output of l… --- ## [Load balancing](https://discuss.elastic.co/t/load-balancing/99034)
**Author:** [@hburnswell](https://discuss.elastic.co/u/hburnswell)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 6:22pm UTC](https://discuss.elastic.co/t/load-balancing/99034 "2017-08-31T18:22:49Z")
All, I'm coming up to speed with the ELK stack in general and have a couple questions about best practices. I'm starting with ingesting IIS logs with Filebeat -\> Logstash -\> Elasticsearch. I am loadbalancing with: f… --- ## [Is there a way to get a more verbose response than just "\_grokparsefailure"](https://discuss.elastic.co/t/is-there-a-way-to-get-a-more-verbose-response-than-just--grokparsefailure/98915)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 5\ **Last updated:** [August 31, 2017, 6:09pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-a-more-verbose-response-than-just--grokparsefailure/98915 "2017-08-31T18:09:24Z")
Hello, I have been using grok filtering for a couple months now and have noticed the pain point of the very vague grok parse failure tag. I am wondering if there is a way for that to give a little bit more detail on whe… --- ## [Logstahs behavior about empty lines](https://discuss.elastic.co/t/logstahs-behavior-about-empty-lines/98971)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 8\ **Last updated:** [August 31, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstahs-behavior-about-empty-lines/98971 "2017-08-31T15:11:22Z")
Hello, I want know how logstash interprete empty lines in a flat file. I must to place a particular option (see my filter below) or by itself he will ignore them? I retrive file and I apply a csv filter on it. I delete… --- ## [Send specific data to nagios](https://discuss.elastic.co/t/send-specific-data-to-nagios/99005)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 1:15pm UTC](https://discuss.elastic.co/t/send-specific-data-to-nagios/99005 "2017-08-31T13:15:15Z")
Hello, I would like to know if there is a way to send specific data (for example, the number of transaction parsed) to nagios. I read about the nagios output plugin, but I am not sure if it can do that. Thanks --- ## [JDBC Plugin - sql\_last\_value equals a not existing timestamp](https://discuss.elastic.co/t/jdbc-plugin-sql-last-value-equals-a-not-existing-timestamp/96605)
**Author:** [@mberger1](https://discuss.elastic.co/u/mberger1)\ **Replies:** 2\ **Last updated:** [August 31, 2017, 1:10pm UTC](https://discuss.elastic.co/t/jdbc-plugin-sql-last-value-equals-a-not-existing-timestamp/96605 "2017-08-31T13:10:28Z")
Hey there, I recently began to use the JDBC Plugin, which will be used to copy data (log data to be specific) from a table within an oracle database. Data is written there every few minutes later on and I just want to u… --- ## [Logstash: Connection Issue](https://discuss.elastic.co/t/logstash-connection-issue/99001)
**Author:** [@Yuvraj\_Kandekar](https://discuss.elastic.co/u/Yuvraj_Kandekar)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 12:42pm UTC](https://discuss.elastic.co/t/logstash-connection-issue/99001 "2017-08-31T12:42:29Z")
Hello, I have setup of Kibana | Elasticsearch | Logstash | Filebeat When I try to Telnet logstash sometimes suddenly gets disconnected with message “Connection closed by foreign host”, Sometimes “Connection refu… --- ## [Logstash-output-mongodb Error::NoServerAvailable:](https://discuss.elastic.co/t/logstash-output-mongodb-error-noserveravailable/97457)
**Author:** [@irom77](https://discuss.elastic.co/u/irom77)\ **Replies:** 1\ **Last updated:** [August 31, 2017, 11:34am UTC](https://discuss.elastic.co/t/logstash-output-mongodb-error-noserveravailable/97457 "2017-08-31T11:34:49Z")
Getting Error::NoServerAvailable: , my output is pretty simple and mono uri verified, please advise output { if \[type\] == "threat" { # Use mongodb to store logstash event. mongodb { … --- ## [Unable to create logstash.conf for log file](https://discuss.elastic.co/t/unable-to-create-logstash-conf-for-log-file/98933)
**Author:** [@ramesh205](https://discuss.elastic.co/u/ramesh205)\ **Replies:** 14\ **Last updated:** [August 31, 2017, 10:53am UTC](https://discuss.elastic.co/t/unable-to-create-logstash-conf-for-log-file/98933 "2017-08-31T10:53:11Z")
Please correct my logstash.conf as i am getting below error message and in kibana i can see my data in dev tool (GET /\_search) but not able to view data in discover tab Q1.I need to add any index in logstash.conf? Q2.i… --- ## [Visualize GEO location](https://discuss.elastic.co/t/visualize-geo-location/98937)
**Author:** [@immandotnet](https://discuss.elastic.co/u/immandotnet)\ **Replies:** 14\ **Last updated:** [August 31, 2017, 10:33am UTC](https://discuss.elastic.co/t/visualize-geo-location/98937 "2017-08-31T10:33:15Z")
I am trying to visualize GEO locations using ELK but getting an exception while selecting the bucket GEO coordinates “No Compatible Fields: The “\_\_\_\_” index pattern does not contain any of the following field types: geo\_… --- ## [Strange behaviour of metrics.count](https://discuss.elastic.co/t/strange-behaviour-of-metrics-count/98981)
**Author:** [@Par\_Svensson](https://discuss.elastic.co/u/Par_Svensson)\ **Replies:** 1\ **Last updated:** [August 31, 2017, 10:02am UTC](https://discuss.elastic.co/t/strange-behaviour-of-metrics-count/98981 "2017-08-31T10:02:33Z")
I’m seeing intermittent drops of the count value in the metrics plugin that I cant explain. \[42\] My setup is that I have an java application, using the logstash-logback-encoder, configured to emit only ERROR log messag… --- ## [UDP listener died but conf file seems ok](https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973)
**Author:** [@Sever](https://discuss.elastic.co/u/Sever)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 8:55am UTC](https://discuss.elastic.co/t/udp-listener-died-but-conf-file-seems-ok/98973 "2017-08-31T08:55:11Z")
Hi i have a problem with logstash. I try to open port 5514, but when i start logstash, the port doesnt work. in Log i can see that UDP listener start and then shutting down. I don't know why \[2017-08-31T08:31:23,647\]\[I… --- ## [Grok Custom Pattern creation](https://discuss.elastic.co/t/grok-custom-pattern-creation/98946)
**Author:** [@aditya\_soni](https://discuss.elastic.co/u/aditya_soni)\ **Replies:** 0\ **Last updated:** [August 31, 2017, 6:31am UTC](https://discuss.elastic.co/t/grok-custom-pattern-creation/98946 "2017-08-31T06:31:20Z")
JHi All, So here is a sample of my log: 23:28:32.226 WARN \[MsgParser:ListProc-Q0:I5\] Parsing error Error mapping the fieldAdditional Information: at com.authentic.mapper.parsing.LengthVar.readBytes(LengthVar.java:… --- ## [Logstash error plugin-email](https://discuss.elastic.co/t/logstash-error-plugin-email/98815)
**Author:** [@yoyo](https://discuss.elastic.co/u/yoyo)\ **Replies:** 6\ **Last updated:** [August 31, 2017, 6:21am UTC](https://discuss.elastic.co/t/logstash-error-plugin-email/98815 "2017-08-31T06:21:17Z")
After running logstash to send emails , one of the messages has been blocked. So the logstash shows me this error \[2017-08-30T09:29:35,862\]\[ERROR\]\[logstash.shutdownwatcher \] The shutdown process appears to be stalled du… --- ## [How to install logstash-output-solr plugin in logstash 5.5](https://discuss.elastic.co/t/how-to-install-logstash-output-solr-plugin-in-logstash-5-5/98154)
**Author:** [@soumya1](https://discuss.elastic.co/u/soumya1)\ **Replies:** 9\ **Last updated:** [August 31, 2017, 5:45am UTC](https://discuss.elastic.co/t/how-to-install-logstash-output-solr-plugin-in-logstash-5-5/98154 "2017-08-31T05:45:36Z")
how to install logstash-output-solr plugin in logstash 5.5.pls help --- ## [Logstash S3 input plugin - prefix wildcard](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-wildcard/97982)
**Author:** [@Tito](https://discuss.elastic.co/u/Tito)\ **Replies:** 1\ **Last updated:** [August 31, 2017, 5:29am UTC](https://discuss.elastic.co/t/logstash-s3-input-plugin-prefix-wildcard/97982 "2017-08-31T05:29:58Z")
Hello, we send logs from our ec2 instances to s3 buckets, to directories like i.e. “logs/name\_of\_the\_server/2017/08/22/httpd/” where 20170822 is current day, httpd - name of the service from which we sent logs, is it p… --- ## [Correct configuration file for XML input](https://discuss.elastic.co/t/correct-configuration-file-for-xml-input/97415)
**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\ **Replies:** 9\ **Last updated:** [August 31, 2017, 4:52am UTC](https://discuss.elastic.co/t/correct-configuration-file-for-xml-input/97415 "2017-08-31T04:52:14Z")
My log look like this which is “|” separated. The log consist of id, status, request, response fields. The request and response are present in XML data which are “|” separated. 110000|read|\ **Author:** [@Xopp](https://discuss.elastic.co/u/Xopp)\ **Replies:** 3\ **Last updated:** [August 31, 2017, 2:18am UTC](https://discuss.elastic.co/t/learning-grok-filter/98670 "2017-08-31T02:18:02Z") Hi everyone, im newbie with Elastic Stack Following to https://grokdebug.herokuapp.com/ i can create very simple grok filter like 2017-08-28T04:34:32.651Z ABC 123123 671 =\> %{TIMESTAMP\_ISO8601} %{WORD} %{NUMBER} %{NUMB… --- ## [Are persistent queues needed with Filebeat?](https://discuss.elastic.co/t/are-persistent-queues-needed-with-filebeat/98756)
**Author:** [@baldur](https://discuss.elastic.co/u/baldur)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 10:05pm UTC](https://discuss.elastic.co/t/are-persistent-queues-needed-with-filebeat/98756 "2017-08-30T22:05:24Z")
Hi all, I’m testing a simple Elastic Stack deployment to test Logstash without persistent queues. In this deployment, Logstash only gets data from Filebeats (apache logs). Both Logstash and Filebeat run fine and seem to… --- ## [GROK NUMBER field type creating field as string and not number](https://discuss.elastic.co/t/grok-number-field-type-creating-field-as-string-and-not-number/98906)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 7:51pm UTC](https://discuss.elastic.co/t/grok-number-field-type-creating-field-as-string-and-not-number/98906 "2017-08-30T19:51:14Z")
I have a created a GROK pattern to parse out a “number” field on an access log, but when i look at the data in the kibana management console it is showing these fields as a string. Any thoughts on this? GROK pattern: %… --- ## [Logstash date filter and @timestamp field](https://discuss.elastic.co/t/logstash-date-filter-and-timestamp-field/98702)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 9\ **Last updated:** [August 30, 2017, 7:49pm UTC](https://discuss.elastic.co/t/logstash-date-filter-and-timestamp-field/98702 "2017-08-30T19:49:25Z")
Hi All, we tried to change the @timestamp field with the same value identified into Apache access logs, but if we tried to configure the date filter we noticed a grok parse failure for all the items. Did someone notice… --- ## [How to remove spacial character \\ added by logstash?](https://discuss.elastic.co/t/how-to-remove-spacial-character-added-by-logstash/98743)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 2\ **Last updated:** [August 30, 2017, 7:26pm UTC](https://discuss.elastic.co/t/how-to-remove-spacial-character-added-by-logstash/98743 "2017-08-30T19:26:32Z")
Hi, I have a field which contains several double quotes. Problem here is, Logstash is adding \\ where ever there is double quote. How to remove that special character? I tried mutate with gsub but it’s not working. Pleas… --- ## [Logstash executable accepts filebeat data, but when installed as service not working with same conf files](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792)
**Author:** [@sunny1](https://discuss.elastic.co/u/sunny1)\ **Replies:** 17\ **Last updated:** [August 30, 2017, 7:08pm UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792 "2017-08-30T19:08:41Z")
Hi All, I am in process of setting up ELK for monitoring my data. Elastic and Kibana is installed as service. For testing purpose i had filebeat and logstash running from executable. I checked everything is working fin… --- ## [UDP listener problem](https://discuss.elastic.co/t/udp-listener-problem/98677)
**Author:** [@pierre1](https://discuss.elastic.co/u/pierre1)\ **Replies:** 8\ **Last updated:** [August 30, 2017, 6:55pm UTC](https://discuss.elastic.co/t/udp-listener-problem/98677 "2017-08-30T18:55:17Z")
Hey i have a probleme with UDP: my conf : firewalld and selinux disable logtstash 5.5-2 my conf : input { udp { port =\> 9556 host =\> "1.1.1.55" workers =\> 2 codec =\> netflow { versions =\> \[5, 9\] target =\> "nf… --- ## [LOGSTASH convert unix ms timestamp](https://discuss.elastic.co/t/logstash-convert-unix-ms-timestamp/98897)
**Author:** [@Gaurav\_Yadav](https://discuss.elastic.co/u/Gaurav_Yadav)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 5:18pm UTC](https://discuss.elastic.co/t/logstash-convert-unix-ms-timestamp/98897 "2017-08-30T17:18:19Z")
Hi, I am quite new to Logstash , i was able to successfully push the messages from Logstash over to ElasticSearch, however the @timestamp is different from the one specified in logs. I want to set the log time to @times… --- ## [How to output filter results before applying next filter](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862)
**Author:** [@Leluke](https://discuss.elastic.co/u/Leluke)\ **Replies:** 3\ **Last updated:** [August 30, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862 "2017-08-30T17:11:24Z")
Hi there, I would like to be able to debug my pipeline configuration. I apply a series of filters, and at the end I output to a json file. It works as it should, and a skeleton of the code would be this: filter { whate… --- ## [No .raw field in kibana](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 3\ **Last updated:** [August 30, 2017, 4:21pm UTC](https://discuss.elastic.co/t/no-raw-field-in-kibana/98425 "2017-08-30T16:21:03Z")
I am seeing an issues where i am not seeing .raw fields but instead i am seeing .keyword fields. I know there was a problem when you change the default index name from logstash-\* to something else but couldn’t recall the… --- ## [Making sense of logstash error logs](https://discuss.elastic.co/t/making-sense-of-logstash-error-logs/98590)
**Author:** [@bm1391](https://discuss.elastic.co/u/bm1391)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 4:12pm UTC](https://discuss.elastic.co/t/making-sense-of-logstash-error-logs/98590 "2017-08-30T16:12:32Z")
Here is logstash.log file when restarting logstash and loading my csv file. It appears to load fine and I can view the contents in Kibana but I can't figure out this error message. \` , "CVSS"=\>"CVSS", "Severity"=\>"Sev… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=915) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=917)