# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=921 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 922 --- ## [2 Inputs and 1 Output. Can we pass events from 1 input to other input](https://discuss.elastic.co/t/2-inputs-and-1-output-can-we-pass-events-from-1-input-to-other-input/97883)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 7\ **Last updated:** [August 23, 2017, 1:41pm UTC](https://discuss.elastic.co/t/2-inputs-and-1-output-can-we-pass-events-from-1-input-to-other-input/97883 "2017-08-23T13:41:56Z")
Hi All i Have created 2 conf files Conf1 : No problem in this conf file { input file.... } { output elasticsearch { index =\> "test1" … --- ## [Is it possible to prevent logstash to start until a config file is available?](https://discuss.elastic.co/t/is-it-possible-to-prevent-logstash-to-start-until-a-config-file-is-available/98026)
**Author:** [@remziay](https://discuss.elastic.co/u/remziay)\ **Replies:** 1\ **Last updated:** [August 23, 2017, 1:07pm UTC](https://discuss.elastic.co/t/is-it-possible-to-prevent-logstash-to-start-until-a-config-file-is-available/98026 "2017-08-23T13:07:25Z")
Hello , my logstash is being started by a process with config.reload.automatic option. i.e ./logstash -f $PATH\_TO\_CONFIG\_FILES --config.reload.automatic I have many configuration files and they are being generated at ru… --- ## [Get time difference of two terms in date](https://discuss.elastic.co/t/get-time-difference-of-two-terms-in-date/98077)
**Author:** [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\ **Replies:** 0\ **Last updated:** [August 23, 2017, 12:40pm UTC](https://discuss.elastic.co/t/get-time-difference-of-two-terms-in-date/98077 "2017-08-23T12:40:40Z")
Hi, I have searched the query in previous asked question. We are having two field RequestInTime and ResponeOuTime which is in DATA format rather than Date format because of some time RequestInTime is 0. file:///home/v… --- ## [Multiple Logstash Instance in one machine](https://discuss.elastic.co/t/multiple-logstash-instance-in-one-machine/96717)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 17\ **Last updated:** [August 23, 2017, 11:52am UTC](https://discuss.elastic.co/t/multiple-logstash-instance-in-one-machine/96717 "2017-08-23T11:52:48Z")
How can I setup multiple logstash instance in one machine? My idea is to gather logs and then forward the data to two elasticsearch host machine as well. If you’ll ask why not to config in just single logstash with 2 e… --- ## [Logstash data formatting help](https://discuss.elastic.co/t/logstash-data-formatting-help/97834)
**Author:** [@capaneus](https://discuss.elastic.co/u/capaneus)\ **Replies:** 1\ **Last updated:** [August 23, 2017, 10:57am UTC](https://discuss.elastic.co/t/logstash-data-formatting-help/97834 "2017-08-23T10:57:53Z")
Hi, I know this is very basic newbee question, but I hope can get some of your time to shed me some light on this. Now I have structured json data after a few filters: filter { json { source =\> “message” } split… --- ## [I don't want all data output to the elasticsearch](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 2\ **Last updated:** [August 23, 2017, 10:15am UTC](https://discuss.elastic.co/t/i-dont-want-all-data-output-to-the-elasticsearch/98030 "2017-08-23T10:15:13Z")
I found that the filter plugin can’t filter wrong format message and all data would output to the elasticsearch. If I want to filter out wrong data let wrong data can’t output to the elasticsearch ,how can I do. this i… --- ## [Grok filter not working after add tags](https://discuss.elastic.co/t/grok-filter-not-working-after-add-tags/97892)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 2\ **Last updated:** [August 23, 2017, 8:01am UTC](https://discuss.elastic.co/t/grok-filter-not-working-after-add-tags/97892 "2017-08-23T08:01:43Z")
Hi experts. I already setup ELK stack and it working normaly. with my grok filter grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:Time} %{WORD:Method} %{NUMBER:Http\_stt} %{NUMBER:ResTime}" } add\_field =\>… --- ## [Not all document showing up in logstash output log end up in elastic search](https://discuss.elastic.co/t/not-all-document-showing-up-in-logstash-output-log-end-up-in-elastic-search/97996)
**Author:** [@jaakko.t.paakkonen](https://discuss.elastic.co/u/jaakko.t.paakkonen)\ **Replies:** 0\ **Last updated:** [August 23, 2017, 5:15am UTC](https://discuss.elastic.co/t/not-all-document-showing-up-in-logstash-output-log-end-up-in-elastic-search/97996 "2017-08-23T05:15:02Z")
Hi Cluster with only one ES 5.5.2 machine, runing also Kibana and logstash (ubuntu 16), filebeat sending logs to logstash. Logstash receiving parsing and everything working correctly. But when I increase the amount of… --- ## [Field duplicate and truncate](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 3\ **Last updated:** [August 23, 2017, 4:16am UTC](https://discuss.elastic.co/t/field-duplicate-and-truncate/97745 "2017-08-23T04:16:00Z")
I need to duplicate my event field and manipulate the string field length to 5 characters . This is my sample log: {"LogLevel":"INFO","LogMsg":"Checked existing Slots ... 180 more lines","Time":"2017-08-21\_12:01:48.882… --- ## [Logstash Output to Webhdfs in CSV Format](https://discuss.elastic.co/t/logstash-output-to-webhdfs-in-csv-format/97994)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 0\ **Last updated:** [August 23, 2017, 4:01am UTC](https://discuss.elastic.co/t/logstash-output-to-webhdfs-in-csv-format/97994 "2017-08-23T04:01:01Z")
Hello, someone here knows how to output in webhdfs in csv format? --- ## [Calling logstash filter plugin api from java code](https://discuss.elastic.co/t/calling-logstash-filter-plugin-api-from-java-code/97971)
**Author:** [@hellosb](https://discuss.elastic.co/u/hellosb)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 7:48pm UTC](https://discuss.elastic.co/t/calling-logstash-filter-plugin-api-from-java-code/97971 "2017-08-22T19:48:16Z")
I have bunch of custom filter(parsers and enrichment) plugins in logstash. Now my requirement is to provide similar functionality at service layer which is implemented in java. I want to avoid re implementing(and mainta… --- ## [Logstash cloudtrail codec doesn't work](https://discuss.elastic.co/t/logstash-cloudtrail-codec-doesnt-work/95791)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 5:20pm UTC](https://discuss.elastic.co/t/logstash-cloudtrail-codec-doesnt-work/95791 "2017-08-22T17:20:30Z")
Hi, I am trying to user the logstash codec cloudtrail to ingest cloudtrail data but that doesn’t seem to work. 16:27:00.265 \[\[main\]\ **Author:** [@njkl](https://discuss.elastic.co/u/njkl)\ **Replies:** 4\ **Last updated:** [August 22, 2017, 5:10pm UTC](https://discuss.elastic.co/t/documents-order-in-elasticsearch-after-processing-with-filebeat-logstash/95980 "2017-08-22T17:10:31Z") Hi, I have the following setup to gather data : filebeat -\> logstash -\> elastichsearch As input I have files with the following plain text format : 2017-07-25 10:36:07,988 21 User 1 Ligne 0 2017-07-25 10:36… --- ## [Multiple filters are beeing ignored, trying to add multiple fields for cloudwatch](https://discuss.elastic.co/t/multiple-filters-are-beeing-ignored-trying-to-add-multiple-fields-for-cloudwatch/97935)
**Author:** [@randahlem](https://discuss.elastic.co/u/randahlem)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 3:10pm UTC](https://discuss.elastic.co/t/multiple-filters-are-beeing-ignored-trying-to-add-multiple-fields-for-cloudwatch/97935 "2017-08-22T15:10:30Z")
Hi, Logstash version 6.0.0-beta1 and also latest stable has been tested. i have the following pretty simple config: input { http\_poller { urls =\> { test1 =\> "http://localhost:3030/" } request\_t… --- ## [Receiving and displaying logs in kibana over openvpn](https://discuss.elastic.co/t/receiving-and-displaying-logs-in-kibana-over-openvpn/97928)
**Author:** [@bm1391](https://discuss.elastic.co/u/bm1391)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 2:44pm UTC](https://discuss.elastic.co/t/receiving-and-displaying-logs-in-kibana-over-openvpn/97928 "2017-08-22T14:44:49Z")
I have configured a ELK stack and I am having problems getting Kibana to display the logs only\* over our VPN. Our logstash server is 10.100.1.10 and the openvpn server is 10.200.1.0/24 network. I am able to send test log… --- ## [Looking for a little assistance regarding ELK Stack and BRO logs](https://discuss.elastic.co/t/looking-for-a-little-assistance-regarding-elk-stack-and-bro-logs/97124)
**Author:** [@BIitzkrieg](https://discuss.elastic.co/u/BIitzkrieg)\ **Replies:** 4\ **Last updated:** [August 21, 2017, 5:11pm UTC](https://discuss.elastic.co/t/looking-for-a-little-assistance-regarding-elk-stack-and-bro-logs/97124 "2017-08-21T17:11:57Z")
I think this fits more with Logstash (maybe Filebeat as well) so I’ll place it here for now. I am currently collecting logs with BRO IDS, and sending from filebeat on the IDS system, to another system running logstash an… --- ## [Unable to replace @timestamp with some other field in logstash](https://discuss.elastic.co/t/unable-to-replace-timestamp-with-some-other-field-in-logstash/97425)
**Author:** [@shraddha1](https://discuss.elastic.co/u/shraddha1)\ **Replies:** 5\ **Last updated:** [August 22, 2017, 2:08pm UTC](https://discuss.elastic.co/t/unable-to-replace-timestamp-with-some-other-field-in-logstash/97425 "2017-08-22T14:08:36Z")
I want to map @timestamp value with some other field. I referred your answers online but could not resolve the issue. I have converted string to date and want this date to be reflected in @timestamp. but no luck. Below… --- ## [How to calculate the filesize in logstash](https://discuss.elastic.co/t/how-to-calculate-the-filesize-in-logstash/95379)
**Author:** [@sudi\_2611](https://discuss.elastic.co/u/sudi_2611)\ **Replies:** 1\ **Last updated:** [August 22, 2017, 1:23pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-filesize-in-logstash/95379 "2017-08-22T13:23:59Z")
Hi, i am new to elasticsearch, am i trying to calculate the HDFS space conumption via kibana… i have a fsimage which contains the csv file from cluster…the file size is in byes and my code in logstash is as follows: f… --- ## [Has anyone implemented logstash with fsimage?](https://discuss.elastic.co/t/has-anyone-implemented-logstash-with-fsimage/97913)
**Author:** [@sudi\_2611](https://discuss.elastic.co/u/sudi_2611)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 1:10pm UTC](https://discuss.elastic.co/t/has-anyone-implemented-logstash-with-fsimage/97913 "2017-08-22T13:10:04Z")
has anyone implemented logstash with fsimage? --- ## [Logstash UDP listener died](https://discuss.elastic.co/t/logstash-udp-listener-died/97843)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843 "2017-08-22T11:37:57Z")
Hi everyone, I am trying to receive fortigate syslog from port 514, but there are some errors here’s my configure: input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } output { el… --- ## [Solr\_http plugin to solr cloud](https://discuss.elastic.co/t/solr-http-plugin-to-solr-cloud/97896)
**Author:** [@soumya1](https://discuss.elastic.co/u/soumya1)\ **Replies:** 0\ **Last updated:** [August 22, 2017, 11:21am UTC](https://discuss.elastic.co/t/solr-http-plugin-to-solr-cloud/97896 "2017-08-22T11:21:34Z")
Hi this is my sample conf to send logs to solr in cluster mode on a production set up.I am able to send data to sample collections but am having troubles to send data to solr cloud in production mode. pls suggest what u… --- ## [Case Insensitive](https://discuss.elastic.co/t/case-insensitive/97798)
**Author:** [@ltwarner](https://discuss.elastic.co/u/ltwarner)\ **Replies:** 1\ **Last updated:** [August 22, 2017, 10:42am UTC](https://discuss.elastic.co/t/case-insensitive/97798 "2017-08-22T10:42:22Z")
Need to be able to look for a source using any type of case I am a bit unsure of the syntax, this command works as long as the source is exactly as this, but ideally I want it to search for any type of case as path can … --- ## [Multiple JDBC Inputs in Single Logstash Config File - Unknown Error](https://discuss.elastic.co/t/multiple-jdbc-inputs-in-single-logstash-config-file-unknown-error/97333)
**Author:** [@r4z0rw1r3666](https://discuss.elastic.co/u/r4z0rw1r3666)\ **Replies:** 6\ **Last updated:** [August 22, 2017, 4:10am UTC](https://discuss.elastic.co/t/multiple-jdbc-inputs-in-single-logstash-config-file-unknown-error/97333 "2017-08-22T04:10:41Z")
Hello, I’ve had limited success in running multiple (4 concurrent) SQL queries from an Oracle Database, and pushing their data across to my Elastic server. When these queries run once a minute, the first 1-2 queries wi… --- ## [How to run multiple instances on one machine using the jdbc input plugin](https://discuss.elastic.co/t/how-to-run-multiple-instances-on-one-machine-using-the-jdbc-input-plugin/97704)
**Author:** [@JCereal](https://discuss.elastic.co/u/JCereal)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 2:21am UTC](https://discuss.elastic.co/t/how-to-run-multiple-instances-on-one-machine-using-the-jdbc-input-plugin/97704 "2017-08-22T02:21:05Z")
Hi all, I have got 6 configuration files. All of them are using jbdc plugin to read data from MySQL every minute as input and elastic search as output. Each instance write into different index, so I have got six config … --- ## [Process ignoring parts of logstash.yml?](https://discuss.elastic.co/t/process-ignoring-parts-of-logstash-yml/97821)
**Author:** [@suboptimalprime](https://discuss.elastic.co/u/suboptimalprime)\ **Replies:** 3\ **Last updated:** [August 21, 2017, 8:21pm UTC](https://discuss.elastic.co/t/process-ignoring-parts-of-logstash-yml/97821 "2017-08-21T20:21:33Z")
Hoping someone can explain this, was unable to find relative posts. Running into an issue where my logstash.yml settings are only partially being read when I start my logstash service. Hostname is read, but nearly all … --- ## [Loadtest a logging solution](https://discuss.elastic.co/t/loadtest-a-logging-solution/97812)
**Author:** [@AlexW](https://discuss.elastic.co/u/AlexW)\ **Replies:** 0\ **Last updated:** [August 21, 2017, 6:32pm UTC](https://discuss.elastic.co/t/loadtest-a-logging-solution/97812 "2017-08-21T18:32:26Z")
Hi! I have a logging system which is basicly standard. Logstash ships into Kafka, Logstash pulls from Kafka and puts the messages into Elasticsearch. The shipper logstashs open several ports for different formats (like … --- ## [LogStach installation issue on Ubuntu](https://discuss.elastic.co/t/logstach-installation-issue-on-ubuntu/97768)
**Author:** [@muneeb](https://discuss.elastic.co/u/muneeb)\ **Replies:** 6\ **Last updated:** [August 21, 2017, 5:48pm UTC](https://discuss.elastic.co/t/logstach-installation-issue-on-ubuntu/97768 "2017-08-21T17:48:34Z")
I’m trying to run logstach-5.5.2 on ubuntu-14.04 LTS. but it’s giving me following error. "Could not find any executable java binary. Please install java in your PATH or set JAVA\_HOME." But JAVA\_HOME is already set. th… --- ## [Having problem in reverse mapping of hostname to ip address using DNS filter](https://discuss.elastic.co/t/having-problem-in-reverse-mapping-of-hostname-to-ip-address-using-dns-filter/97769)
**Author:** [@Ram\_Prasath](https://discuss.elastic.co/u/Ram_Prasath)\ **Replies:** 2\ **Last updated:** [August 21, 2017, 3:13pm UTC](https://discuss.elastic.co/t/having-problem-in-reverse-mapping-of-hostname-to-ip-address-using-dns-filter/97769 "2017-08-21T15:13:26Z")
I am trying to use the DNS filter to map the hostname to IPaddress , below is the sample configuration I tried to map google.com to ipaddress filter{ mutate { add\_field =\> {"hostname", "google.com"} } … --- ## [Translate filter to match the custom values](https://discuss.elastic.co/t/translate-filter-to-match-the-custom-values/97773)
**Author:** [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Replies:** 1\ **Last updated:** [August 21, 2017, 2:44pm UTC](https://discuss.elastic.co/t/translate-filter-to-match-the-custom-values/97773 "2017-08-21T14:44:58Z")
I would like to use the translate filter dictionary plugin to define my custom values. It seems simple to use it, though is it possible to have something like this translate { dictionary =\> \[ "2", "f", "3", "16e",… --- ## [Change null value from database for one field using logstash and insert into Elasticsearch](https://discuss.elastic.co/t/change-null-value-from-database-for-one-field-using-logstash-and-insert-into-elasticsearch/97552)
**Author:** [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Replies:** 7\ **Last updated:** [August 21, 2017, 1:09pm UTC](https://discuss.elastic.co/t/change-null-value-from-database-for-one-field-using-logstash-and-insert-into-elasticsearch/97552 "2017-08-21T13:09:32Z")
I would like to replace the value of field with NULL to some other value. This field is obtained by using Logstash JDBC plugin from database. Here is my config file. input { jdbc { jdbc\_connection\_string =\> "url" jdbc… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=920) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=922)