# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=922 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 923 --- ## [Logstash jdbc\_default\_timezone issue (bug)](https://discuss.elastic.co/t/logstash-jdbc-default-timezone-issue-bug/97578)
**Author:** [@bterhorst](https://discuss.elastic.co/u/bterhorst)\ **Replies:** 2\ **Last updated:** [August 21, 2017, 12:24pm UTC](https://discuss.elastic.co/t/logstash-jdbc-default-timezone-issue-bug/97578 "2017-08-21T12:24:38Z")
Hi, I am using the logstash jdbc input but have problems using the jdbc\_default\_timezone. The database I use has timezone Europe/Amsterdam so I thought if I set that as de defaut timezone it would work like a charm. j… --- ## [Filter and Grok](https://discuss.elastic.co/t/filter-and-grok/97273)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 2\ **Last updated:** [August 21, 2017, 11:19am UTC](https://discuss.elastic.co/t/filter-and-grok/97273 "2017-08-21T11:19:28Z")
Hello. I need help about Logstash configuration. I like to define a Filter that extract specific information from my Windows Event Log. For example, In below Windows Event log I just need the Account name and the file o… --- ## [Null result of MySQL query through logstash does not create an index](https://discuss.elastic.co/t/null-result-of-mysql-query-through-logstash-does-not-create-an-index/97721)
**Author:** [@saafianihan](https://discuss.elastic.co/u/saafianihan)\ **Replies:** 2\ **Last updated:** [August 21, 2017, 10:17am UTC](https://discuss.elastic.co/t/null-result-of-mysql-query-through-logstash-does-not-create-an-index/97721 "2017-08-21T10:17:20Z")
I have to Fetch the Today’s status from my MYSQL table. Result From Table is empty. when i creating an index with null result of data the index does not created. What i am missing? this is my config file: input { jdbc… --- ## [Logstash vs rsyslog java stack multiline issue](https://discuss.elastic.co/t/logstash-vs-rsyslog-java-stack-multiline-issue/97557)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 12\ **Last updated:** [August 21, 2017, 9:20am UTC](https://discuss.elastic.co/t/logstash-vs-rsyslog-java-stack-multiline-issue/97557 "2017-08-21T09:20:18Z")
Hi All, Does someone configure a multiline event starting from rsyslog messages? We tried to implement a catch all logstash instance for all the messages forwarded by docker daemons via syslog but we can’t parse the mul… --- ## [Problem with parsing data from two files inputs (csv and syslog)](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730)
**Author:** [@myciokas](https://discuss.elastic.co/u/myciokas)\ **Replies:** 1\ **Last updated:** [August 21, 2017, 9:14am UTC](https://discuss.elastic.co/t/problem-with-parsing-data-from-two-files-inputs-csv-and-syslog/97730 "2017-08-21T09:14:52Z")
Hello, i have problems with input from a file. Info: logstash 5.5, OS centos7 Problem: if i leave only one conf file in logstash/conf.d - it works,but if i put them together it’s starting to fail. (conf files and par… --- ## [Dynamic Mapping CSV file](https://discuss.elastic.co/t/dynamic-mapping-csv-file/97709)
**Author:** [@Chriss](https://discuss.elastic.co/u/Chriss)\ **Replies:** 1\ **Last updated:** [August 21, 2017, 7:06am UTC](https://discuss.elastic.co/t/dynamic-mapping-csv-file/97709 "2017-08-21T07:06:17Z")
Hello, i have an CSV file which i need to import into Elasticsearch. For now it is released with grok: grok { match =\> { “message” =\> "%{NUMBER:count}?;(?\[^\\d\]\*(\\d+))(?\[a-zA-Z\]+)(?\[0-9\]{4});%{TIME:time}?;\[…\] } Unf… --- ## [Logstash elasticsearch input plugin](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin/97700)
**Author:** [@infamous](https://discuss.elastic.co/u/infamous)\ **Replies:** 1\ **Last updated:** [August 21, 2017, 5:52am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin/97700 "2017-08-21T05:52:19Z")
Hi all, I am wondering if there is a way to have the elasticsearch input filter search multiple times instead of once. Right now I am trying to use the filter to watch for changes a certain index and (ideally) have the … --- ## [Unknown setting 'autodetect\_column\_names' for csv](https://discuss.elastic.co/t/unknown-setting-autodetect-column-names-for-csv/97618)
**Author:** [@cchooks2](https://discuss.elastic.co/u/cchooks2)\ **Replies:** 1\ **Last updated:** [August 20, 2017, 6:31pm UTC](https://discuss.elastic.co/t/unknown-setting-autodetect-column-names-for-csv/97618 "2017-08-20T18:31:43Z")
Hello, I am trying to test out a config to the console for a csv file and am getting the following error: Unknown setting ‘autodetect\_column\_names’ for csv My config: input { file { path =\> "/apps/logstash-5.2.0/bi… --- ## [Parsing field sql\_bind into sql\_text](https://discuss.elastic.co/t/parsing-field-sql-bind-into-sql-text/97447)
**Author:** [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Replies:** 1\ **Last updated:** [August 20, 2017, 6:38pm UTC](https://discuss.elastic.co/t/parsing-field-sql-bind-into-sql-text/97447 "2017-08-20T18:38:10Z")
I’m consuming oracle logs using logstash, i want to reconstruct the original sql statement that oracle(using variable binding) writes into two fields sql\_bind and sql\_text. sql\_text contains the sql sent to the database… --- ## [Logstash in distributed environment](https://discuss.elastic.co/t/logstash-in-distributed-environment/97677)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 3\ **Last updated:** [August 20, 2017, 6:20pm UTC](https://discuss.elastic.co/t/logstash-in-distributed-environment/97677 "2017-08-20T18:20:04Z")
Hi All, Could any one tell me how logstash can be used in distributed environment I want to configure logstash in distributed environment and have to run on ETL batch jobs in distributed environment. Thanks in Adva… --- ## [Logstash is not reading the log file(that's being updated automatically) continuously](https://discuss.elastic.co/t/logstash-is-not-reading-the-log-file-thats-being-updated-automatically-continuously/92686)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 15\ **Last updated:** [August 20, 2017, 4:26pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-the-log-file-thats-being-updated-automatically-continuously/92686 "2017-08-20T16:26:37Z")
Hi, I have a log file that will be modified every 6 hours by a script. Problem is Logstash is not reading the file when the file is updated automatically. But when I update the file manually logstash is picking the data.… --- ## [Grok pattern for \[2017-08-19T12:47:43,822\]\[INFO\]](https://discuss.elastic.co/t/grok-pattern-for-2017-08-19t12-47-43-822-info/97656)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 2\ **Last updated:** [August 20, 2017, 10:01am UTC](https://discuss.elastic.co/t/grok-pattern-for-2017-08-19t12-47-43-822-info/97656 "2017-08-20T10:01:21Z")
Hi All, Can any one explain the grok pattern for the below lines, \[2017-08-19T12:47:43,822\]\[INFO\]\[logstash.agent\] Successfully started Logstash API endpoint {:port=\>9600} \[2017-08-19T12:49:47,213\]\[WARN\]\[logstash.ag… --- ## [Status and elapsed time of logstash batch](https://discuss.elastic.co/t/status-and-elapsed-time-of-logstash-batch/97669)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 0\ **Last updated:** [August 20, 2017, 2:20am UTC](https://discuss.elastic.co/t/status-and-elapsed-time-of-logstash-batch/97669 "2017-08-20T02:20:09Z")
Hi All, Can any one tell me how to get status and elapsed time of my logstash batch(pipe/job). I have below config file. Hi all, Please help me out to find the time elapsed and status of the logstash job(logstash pi… --- ## [Configtest Ok if started as process, fails if started as service](https://discuss.elastic.co/t/configtest-ok-if-started-as-process-fails-if-started-as-service/97245)
**Author:** [@xupete](https://discuss.elastic.co/u/xupete)\ **Replies:** 2\ **Last updated:** [August 19, 2017, 1:54pm UTC](https://discuss.elastic.co/t/configtest-ok-if-started-as-process-fails-if-started-as-service/97245 "2017-08-19T13:54:32Z")
First, I am new to Elastissearch and Logstash. I am trying to run an example. Elasticsearch and Kibana start as services when my Ubuntu 14.04 starts, but Logstash fails. Seems a problem when Logstash is started as servi… --- ## [Parsing FreeBSD syslog](https://discuss.elastic.co/t/parsing-freebsd-syslog/97647)
**Author:** [@bane](https://discuss.elastic.co/u/bane)\ **Replies:** 0\ **Last updated:** [August 19, 2017, 3:40am UTC](https://discuss.elastic.co/t/parsing-freebsd-syslog/97647 "2017-08-19T03:40:21Z")
Hi, I am trying to parse FreeBSD syslog. The syslogs are sent to logstash via filebeat. I currently use this grok: filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timest… --- ## [Calculate Elapsed time in logstash pipe](https://discuss.elastic.co/t/calculate-elapsed-time-in-logstash-pipe/97648)
**Author:** [@arunvijayam](https://discuss.elastic.co/u/arunvijayam)\ **Replies:** 0\ **Last updated:** [August 19, 2017, 5:22am UTC](https://discuss.elastic.co/t/calculate-elapsed-time-in-logstash-pipe/97648 "2017-08-19T05:22:45Z")
Hi All, Please help me out to find the elapsed time from pipe started between pipe ended and its status whether it is completed or not. my code is as below, input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin… --- ## [Logstash CSV output plugin not working](https://discuss.elastic.co/t/logstash-csv-output-plugin-not-working/97488)
**Author:** [@ashvita](https://discuss.elastic.co/u/ashvita)\ **Replies:** 2\ **Last updated:** [August 18, 2017, 11:16pm UTC](https://discuss.elastic.co/t/logstash-csv-output-plugin-not-working/97488 "2017-08-18T23:16:06Z")
Hi, I am trying to have 2 outputs in my config file. One elastic search and other csv. But my csv file is not getting generated. Below is my conf file - input{ kafka{ bootstrap\_servers =\> "10.100.208.97:9092" topic… --- ## ["No resolver found for monitoring document" error](https://discuss.elastic.co/t/no-resolver-found-for-monitoring-document-error/97616)
**Author:** [@thomas.parquier](https://discuss.elastic.co/u/thomas.parquier)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 4:55pm UTC](https://discuss.elastic.co/t/no-resolver-found-for-monitoring-document-error/97616 "2017-08-18T16:55:38Z")
I've set plugin settings in logstash.yml (elasticsearch.url), but I got the following error in logstash-plain.log : "No resolver found for monitoring document" --- ## [Logstash and MariaDB won't connect (both dockerized)](https://discuss.elastic.co/t/logstash-and-mariadb-wont-connect-both-dockerized/97499)
**Author:** [@gabrielmll](https://discuss.elastic.co/u/gabrielmll)\ **Replies:** 3\ **Last updated:** [August 18, 2017, 8:52pm UTC](https://discuss.elastic.co/t/logstash-and-mariadb-wont-connect-both-dockerized/97499 "2017-08-18T20:52:24Z")
Hello everyone, newby here, quite excited to learn about elastic and the community. Some help would be great. I'm getting an error when JDBC plugin attempts to connect to mariaDB through the following settings: maria… --- ## [Csv output date with mm/dd/yyyy hh:mm AM format](https://discuss.elastic.co/t/csv-output-date-with-mm-dd-yyyy-hh-mm-am-format/97308)
**Author:** [@chetan\_vartak](https://discuss.elastic.co/u/chetan_vartak)\ **Replies:** 1\ **Last updated:** [August 18, 2017, 8:09pm UTC](https://discuss.elastic.co/t/csv-output-date-with-mm-dd-yyyy-hh-mm-am-format/97308 "2017-08-18T20:09:11Z")
Hi, My input is elasticsearch and I want to output to csv. A date field by default is outputted as - 2017-08-11T18:50:42.000-07:100. I want it to output as 08/11/2017 06:50 PM My current conf file - input { elast… --- ## [Netflow9 Data from Cisco ISR](https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632)
**Author:** [@eman3242](https://discuss.elastic.co/u/eman3242)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 7:42pm UTC](https://discuss.elastic.co/t/netflow9-data-from-cisco-isr/97632 "2017-08-18T19:42:53Z")
Having trouble getting my Netflow9 data to load into Elasticsearch properly. I’m feeding logs from multiple beats sources–and those are working 100% correctly. All of the other sources are creating indices like “firewall… --- ## [Update existing and insert new fields on the same index in elastic search using Logstash config](https://discuss.elastic.co/t/update-existing-and-insert-new-fields-on-the-same-index-in-elastic-search-using-logstash-config/97500)
**Author:** [@vreddy](https://discuss.elastic.co/u/vreddy)\ **Replies:** 4\ **Last updated:** [August 18, 2017, 6:22pm UTC](https://discuss.elastic.co/t/update-existing-and-insert-new-fields-on-the-same-index-in-elastic-search-using-logstash-config/97500 "2017-08-18T18:22:33Z")
Hi, I have scenario where I need to update the document on the elastic search from two different sources, I am creating same document id while processing 2 sources. Lets say at first document has A, B, C fields from fir… --- ## [Logstash elasticsearch output. How to change mapping?](https://discuss.elastic.co/t/logstash-elasticsearch-output-how-to-change-mapping/97617)
**Author:** [@xkovacikm](https://discuss.elastic.co/u/xkovacikm)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 5:13pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-how-to-change-mapping/97617 "2017-08-18T17:13:34Z")
Hi, Problem 1: I’ve got problem with default mapping which is created by logstash. I’ve created my own mapping. But i cant change it. in blogarticles index is still only the default one created by JDBC. I tried to crea… --- ## [ERR Connecting Error](https://discuss.elastic.co/t/err-connecting-error/97613)
**Author:** [@docmur](https://discuss.elastic.co/u/docmur)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 4:39pm UTC](https://discuss.elastic.co/t/err-connecting-error/97613 "2017-08-18T16:39:35Z")
Hey Guys I setup an ELK Server on my server, inside a VM, the ELK's servers IP is 192.168.154.168. I set a client to talk to the ELK Server, it's ip is 192.168.154.155, it's using filebeat over port 5443 to talk to the… --- ## [Logstash can not find plugin after i install it successfully](https://discuss.elastic.co/t/logstash-can-not-find-plugin-after-i-install-it-successfully/97595)
**Author:** [@LiangxiongZhu](https://discuss.elastic.co/u/LiangxiongZhu)\ **Replies:** 2\ **Last updated:** [August 18, 2017, 2:13pm UTC](https://discuss.elastic.co/t/logstash-can-not-find-plugin-after-i-install-it-successfully/97595 "2017-08-18T14:13:49Z")
i would like to extend logstash-input-jdbc so i download it to my local directory. and then i do following things. rename the directory from logstash-input-jdbc to logstash-input-ias\_person rename lib/logstash/inpu… --- ## [ArrayFiled Split Plugin issue](https://discuss.elastic.co/t/arrayfiled-split-plugin-issue/97593)
**Author:** [@sandeeppattem](https://discuss.elastic.co/u/sandeeppattem)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 1:44pm UTC](https://discuss.elastic.co/t/arrayfiled-split-plugin-issue/97593 "2017-08-18T13:44:54Z")
Hi all, JSON Response: “data”:\[{“pttle”:“Logout”,“respt”:21143.5,“avail”:1,“mtime”:1502978400000},{“pttle”:“Submit External Consultant Request”,“respt”:105,“avail”:1,“mtime”:1502978400000},{“pttle”:“Authentication Page… --- ## [How can i install jdbc\_streaming filter plugin](https://discuss.elastic.co/t/how-can-i-install-jdbc-streaming-filter-plugin/97526)
**Author:** [@LiangxiongZhu](https://discuss.elastic.co/u/LiangxiongZhu)\ **Replies:** 2\ **Last updated:** [August 18, 2017, 1:09pm UTC](https://discuss.elastic.co/t/how-can-i-install-jdbc-streaming-filter-plugin/97526 "2017-08-18T13:09:06Z")
i want to use jdbc\_streaming filter plugin, but i get error, “Cannot create pipeline” reason: Couldn’t find any filter plugin named ‘jdbc\_streaming’. then i tried logstash-plugin install jdbc\_streaming. the result of V… --- ## [Split not working in Logstash](https://discuss.elastic.co/t/split-not-working-in-logstash/97580)
**Author:** [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 12:49pm UTC](https://discuss.elastic.co/t/split-not-working-in-logstash/97580 "2017-08-18T12:49:19Z")
Hi I am trying to split my log by placing below code in logstash configuration file: mutate { split =\> { "log\_text" =\> "|" } } The log is breaking perfectly with this. But when I try to break my logs "\\n" instea… --- ## [Xpath from array to single fields](https://discuss.elastic.co/t/xpath-from-array-to-single-fields/97572)
**Author:** [@EloaCardoso](https://discuss.elastic.co/u/EloaCardoso)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 11:55am UTC](https://discuss.elastic.co/t/xpath-from-array-to-single-fields/97572 "2017-08-18T11:55:27Z")
I have a xml file like this: \ \Name\ \Maria\ \ \ \<:ParameterName\>Age\ \ **Author:** [@ppierce01](https://discuss.elastic.co/u/ppierce01)\ **Replies:** 2\ **Last updated:** [August 18, 2017, 11:18am UTC](https://discuss.elastic.co/t/logstash-not-creating-muy-index/97128 "2017-08-18T11:18:00Z") I am attempting to index my IIS logs using logstash. I found an example config file From THIS web site. I used it as is as my Logstash configuration and it ran with no error. I then began seeing this in the command wi… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=921) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=923)