# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=928 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 929 --- ## [Even no errors in services , just one (of two servers) is showed in kibana](https://discuss.elastic.co/t/even-no-errors-in-services-just-one-of-two-servers-is-showed-in-kibana/96646)
**Author:** [@orlapalm](https://discuss.elastic.co/u/orlapalm)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 4:35pm UTC](https://discuss.elastic.co/t/even-no-errors-in-services-just-one-of-two-servers-is-showed-in-kibana/96646 "2017-08-10T16:35:08Z")
I have a central server (virtualized) which show events just for one client even no errors appears on both clients and ELK server. The events what appears belongs to the HOST (which have filebeat running OK). The missi… --- ## [Help on creating GROK patterns](https://discuss.elastic.co/t/help-on-creating-grok-patterns/95413)
**Author:** [@shroh](https://discuss.elastic.co/u/shroh)\ **Replies:** 15\ **Last updated:** [August 10, 2017, 3:50pm UTC](https://discuss.elastic.co/t/help-on-creating-grok-patterns/95413 "2017-08-10T15:50:10Z")
Hi I am kind of new to ELK and also GROK pattern , below is the log file line for which i want to create a GROK pattern, The fields that i need are before the ‘=’ as parsed by splunk \[{applicationSystemCode=appname, cl… --- ## [Elasticsearch filter plugin](https://discuss.elastic.co/t/elasticsearch-filter-plugin/96629)
**Author:** [@Pratheek](https://discuss.elastic.co/u/Pratheek)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 2:23pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/96629 "2017-08-10T14:23:21Z")
I tried using query in elasticsearch filter plugin to retrieve events from an existing index.But its throwing up some warning. My conf for filter is as follows: elasticsearch { hosts =\> \[“localhost:9200”\] index =\> "… --- ## [How to filter based on log\_stream](https://discuss.elastic.co/t/how-to-filter-based-on-log-stream/95780)
**Author:** [@bhedayatian](https://discuss.elastic.co/u/bhedayatian)\ **Replies:** 14\ **Last updated:** [August 10, 2017, 3:17pm UTC](https://discuss.elastic.co/t/how-to-filter-based-on-log-stream/95780 "2017-08-10T15:17:41Z")
hello. in aws cloud watch, i have group 1 that has 4 streams, how can i get logs from just one of the streams in logstash? i am using cloudwatch\_logs plugin in logstash. i have this cloudwatch\_logs { log\_group =\> \[“Gr… --- ## [Change the value of a field](https://discuss.elastic.co/t/change-the-value-of-a-field/96590)
**Author:** [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Replies:** 6\ **Last updated:** [August 10, 2017, 3:03pm UTC](https://discuss.elastic.co/t/change-the-value-of-a-field/96590 "2017-08-10T15:03:53Z")
I have a field called showing up with a value I wish to change clientDisabled = false} I want to get rid of the “}” character at the end without using too complicated a method. I have tried this: if (\[clientDisabled\]… --- ## [Logstash JDBC input interfering with HTTP input?](https://discuss.elastic.co/t/logstash-jdbc-input-interfering-with-http-input/96616)
**Author:** [@bghoang](https://discuss.elastic.co/u/bghoang)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 1:03pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-interfering-with-http-input/96616 "2017-08-10T13:03:43Z")
I have 2 .conf files in /etc/logstash/conf.d: jdbc.conf connects to my DB2 to run some sql queries and pushes data to ES, and works perfectly fine by itself. http.conf opens port 31000 listening for json posts and … --- ## [Logstah filter for cisco device](https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606)
**Author:** [@muratungor](https://discuss.elastic.co/u/muratungor)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 12:07pm UTC](https://discuss.elastic.co/t/logstah-filter-for-cisco-device/96606 "2017-08-10T12:07:47Z")
Hello we have syslog-ng server that collects logs from cisco switches, routers etc. and syslog-ng writes that logs to its filesistem. here is an example of lines from cisco Aug 10 14:56:30 ip…ip.ip.ip hostname: Aug 10 … --- ## [Split problem in logstash](https://discuss.elastic.co/t/split-problem-in-logstash/96545)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 2\ **Last updated:** [August 10, 2017, 7:35am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545 "2017-08-10T07:35:32Z")
my logstash.conf filter { mutate { remove\_field =\> \[ “type”, “tags”, “input\_type”, “@version”, “beat”, “offset”\] } } my discovery logs format: @timestamp:August 8th 2017, 13:45:54.424 host:vNTDACLSnTALK01 source:/… --- ## [JSON parse error, original data now in message field](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/93163)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 3\ **Last updated:** [August 10, 2017, 11:09am UTC](https://discuss.elastic.co/t/json-parse-error-original-data-now-in-message-field/93163 "2017-08-10T11:09:04Z")
Hello, I am getting the following error with looking at edgemax router logs: \[2017-07-14T09:52:00,502\]\[ERROR\]\[logstash.codecs.json \] JSON parse error, original data now in message field {:error=\>#\ **Author:** [@aerys\_targaryen](https://discuss.elastic.co/u/aerys_targaryen)\ **Replies:** 1\ **Last updated:** [August 10, 2017, 11:02am UTC](https://discuss.elastic.co/t/syslog-input-plugin/96585 "2017-08-10T11:02:40Z") Hello Im new to Log Mgmt, ive to forward Windows Events from log collector machine with ArcSight Smart Connector to ELK. Now i came up with creating plugin for log input. Should i create JSon file and paste in directory… --- ## [Unable to load excel csv data in elasticsearch, i am new to this requesting a help](https://discuss.elastic.co/t/unable-to-load-excel-csv-data-in-elasticsearch-i-am-new-to-this-requesting-a-help/96219)
**Author:** [@Shaikh\_Subhan](https://discuss.elastic.co/u/Shaikh_Subhan)\ **Replies:** 6\ **Last updated:** [August 10, 2017, 10:55am UTC](https://discuss.elastic.co/t/unable-to-load-excel-csv-data-in-elasticsearch-i-am-new-to-this-requesting-a-help/96219 "2017-08-10T10:55:43Z")
Hello Mate I created database config file as below. input { stdin { file { path =\> "D:dev tools/data/cars.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } Filter { csv { separator =\> … --- ## [Logstash unable to filter geoip for nginx](https://discuss.elastic.co/t/logstash-unable-to-filter-geoip-for-nginx/96465)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 3\ **Last updated:** [August 10, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-unable-to-filter-geoip-for-nginx/96465 "2017-08-10T10:13:50Z")
Now I have asked this before inside kibana forums and the discussions died with no resolution so I will start again. I have just span up a brand new 5.5 cluster: x2 master nodes (elasticsearch) x2 data nodes (elastics… --- ## [Timeout executing grok & Value too large to output](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400)
**Author:** [@Slop](https://discuss.elastic.co/u/Slop)\ **Replies:** 10\ **Last updated:** [August 10, 2017, 10:08am UTC](https://discuss.elastic.co/t/timeout-executing-grok-value-too-large-to-output/96400 "2017-08-10T10:08:31Z")
Hello, I've already read a lot about that problem but I really don't know what to do precisely. I'm using ELK 5.4.1 since a week now and after adding some grok filters, there is a tons of Timeout on my logstash-plain.… --- ## [\_jsonparsefailure](https://discuss.elastic.co/t/-jsonparsefailure/96577)
**Author:** [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\ **Replies:** 2\ **Last updated:** [August 10, 2017, 9:45am UTC](https://discuss.elastic.co/t/-jsonparsefailure/96577 "2017-08-10T09:45:53Z")
HI, {“header”:{“serialNum”:“014101B112017080814470800”,“hmac”:“jIkNiFUyslKPyzHeZTwrtymNs1/w0xPdmn+Zf5hQDfY=”,“timestamp”:“2017-08-08T14:47:39.284+08:00”},“body”:{“transactionType”:“B”,“etcEntryTimestamp”:“2017-08-08T21:… --- ## [Change java path in config file](https://discuss.elastic.co/t/change-java-path-in-config-file/96457)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 3\ **Last updated:** [August 10, 2017, 8:43am UTC](https://discuss.elastic.co/t/change-java-path-in-config-file/96457 "2017-08-10T08:43:16Z")
Hello, I would like to know in which file I can define the JAVA path in my logstash configuration because my JAVA\_HOME is set to Java 7 and cannot be changed, to avoid that: /usr/share/logstash/bin/logstash -e 'input {… --- ## [Multiline concat order](https://discuss.elastic.co/t/multiline-concat-order/96570)
**Author:** [@Blu3](https://discuss.elastic.co/u/Blu3)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 8:38am UTC](https://discuss.elastic.co/t/multiline-concat-order/96570 "2017-08-10T08:38:11Z")
I’m using multiline codec to file input plugin with following configuration: pattern =\> "^%{DATESTAMP}\\s{2}" negate =\> true what =\> previous So it should append line to a previous entry if there are no two whitespaces … --- ## [Monitoring Sflow using elastic stack](https://discuss.elastic.co/t/monitoring-sflow-using-elastic-stack/96569)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 0\ **Last updated:** [August 10, 2017, 8:36am UTC](https://discuss.elastic.co/t/monitoring-sflow-using-elastic-stack/96569 "2017-08-10T08:36:28Z")
Hi All, We are using elastic stack for monitoring our sflow ,suddenly this morning logstash failed and we were not getting any events to elasticsearch and couldnt see it in kibana. Then i checked in logstash-plain.log… --- ## [Install monitoring license on Logstash](https://discuss.elastic.co/t/install-monitoring-license-on-logstash/96328)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [August 10, 2017, 8:10am UTC](https://discuss.elastic.co/t/install-monitoring-license-on-logstash/96328 "2017-08-10T08:10:42Z")
Hi, I’ve been able to install my license on my ES nodes but I have a dedicated Logstash node that I’d like to install my license to and the method of the ES nodes isn’t working. My steps: Create license.json on LS mac… --- ## [Lumberjack with JDBC configuration](https://discuss.elastic.co/t/lumberjack-with-jdbc-configuration/96485)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 4\ **Last updated:** [August 10, 2017, 7:26am UTC](https://discuss.elastic.co/t/lumberjack-with-jdbc-configuration/96485 "2017-08-10T07:26:28Z")
Hi, Need help with a very typical scenario of getting data using JDBC input plugin and sending it using Logstash - Lumberjack(s) plugins to ES Version Details: ES/LS/Kibana - 5.4.1 I have a database with 2 tables that… --- ## [Output db plugin](https://discuss.elastic.co/t/output-db-plugin/96490)
**Author:** [@Padmavathy](https://discuss.elastic.co/u/Padmavathy)\ **Replies:** 1\ **Last updated:** [August 10, 2017, 6:14am UTC](https://discuss.elastic.co/t/output-db-plugin/96490 "2017-08-10T06:14:17Z")
Is there a way to take input from one database and output it to another database using logstash? I am using oracle database --- ## [A plugin had an unrecoverable error LogStash::Inputs::Beats 5.2.1](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-logstash-inputs-beats-5-2-1/96522)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 1\ **Last updated:** [August 10, 2017, 6:13am UTC](https://discuss.elastic.co/t/a-plugin-had-an-unrecoverable-error-logstash-inputs-beats-5-2-1/96522 "2017-08-10T06:13:44Z")
Hi, I am trying to start my Logstash config in one of my server. I am getting the following error which I couldn’t figure out. I am using Logstash and filebeat version 5.2.1. Filebeat is running on remote server. Erro… --- ## [Unable to get Postgres for Logstash input](https://discuss.elastic.co/t/unable-to-get-postgres-for-logstash-input/96515)
**Author:** [@Isra](https://discuss.elastic.co/u/Isra)\ **Replies:** 0\ **Last updated:** [August 9, 2017, 9:21pm UTC](https://discuss.elastic.co/t/unable-to-get-postgres-for-logstash-input/96515 "2017-08-09T21:21:12Z")
I am using the following: Logstash 5.5.1 postgresql-42.1.4.jar Java version 1.8.0\_141 Windows 10 The following is my logstash config file input { jdbc { jdbc\_driver\_library =\> "PATH\\TO\\p… --- ## [Logstash: Error: mongodb.jdbc.MongoDriver not loaded. Are you sure you've included the correct jdbc driver in :jdbc\_driver\_library?](https://discuss.elastic.co/t/logstash-error-mongodb-jdbc-mongodriver-not-loaded-are-you-sure-youve-included-the-correct-jdbc-driver-in-jdbc-driver-library/93418)
**Author:** [@PravinDwiwedi](https://discuss.elastic.co/u/PravinDwiwedi)\ **Replies:** 3\ **Last updated:** [August 9, 2017, 7:04pm UTC](https://discuss.elastic.co/t/logstash-error-mongodb-jdbc-mongodriver-not-loaded-are-you-sure-youve-included-the-correct-jdbc-driver-in-jdbc-driver-library/93418 "2017-08-09T19:04:39Z")
Hi, I am getting below error while using Mongodb Java Driver to ready data from MongoDB and push it to ES- Error: mongodb.jdbc.MongoDriver not loaded. Are you sure you've included the correct jdbc driver in :jdbc\_driv… --- ## [Logstash filtering issue](https://discuss.elastic.co/t/logstash-filtering-issue/96436)
**Author:** [@himaz.m](https://discuss.elastic.co/u/himaz.m)\ **Replies:** 3\ **Last updated:** [August 9, 2017, 6:43pm UTC](https://discuss.elastic.co/t/logstash-filtering-issue/96436 "2017-08-09T18:43:45Z")
I'm using filebeat, logstash and kibana. I see an issue in Kibana which looks like the logstash grok pattern was not applied for some of the log lines. I don't see an issue in the log lines even, both filtered and unfil… --- ## [Encrypted password](https://discuss.elastic.co/t/encrypted-password/95353)
**Author:** [@Padmavathy](https://discuss.elastic.co/u/Padmavathy)\ **Replies:** 3\ **Last updated:** [August 9, 2017, 6:37pm UTC](https://discuss.elastic.co/t/encrypted-password/95353 "2017-08-09T18:37:24Z")
Is there a way to encrypt and store password in logstash config file --- ## [Grok filter pattern file with capture group regex](https://discuss.elastic.co/t/grok-filter-pattern-file-with-capture-group-regex/96247)
**Author:** [@jarlrmai](https://discuss.elastic.co/u/jarlrmai)\ **Replies:** 1\ **Last updated:** [August 9, 2017, 6:23pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-file-with-capture-group-regex/96247 "2017-08-09T18:23:06Z")
\\bSeverity=\\\\\\"(?\\[^\\\\\\"\]\*) I have the above regex for Grok, It works on the Grok Debugger \[View@6876 Severity=\\"INFO\\" Module= becomes { "severity": \[ \[ "INFO" \] \] } How do I add this to … --- ## [Send metric when filter not match](https://discuss.elastic.co/t/send-metric-when-filter-not-match/96487)
**Author:** [@bitesize](https://discuss.elastic.co/u/bitesize)\ **Replies:** 0\ **Last updated:** [August 9, 2017, 5:26pm UTC](https://discuss.elastic.co/t/send-metric-when-filter-not-match/96487 "2017-08-09T17:26:55Z")
I have a field called “eventid” that if it matches a certain value, for example, “2” then I tag it with “alert” and add \[@metadata\]\[…\] to send to a Zabbix trapper. The problem is when there is no input with that specifi… --- ## [5.2.x environment variables bug?](https://discuss.elastic.co/t/5-2-x-environment-variables-bug/96482)
**Author:** [@bghoang](https://discuss.elastic.co/u/bghoang)\ **Replies:** 0\ **Last updated:** [August 9, 2017, 4:53pm UTC](https://discuss.elastic.co/t/5-2-x-environment-variables-bug/96482 "2017-08-09T16:53:00Z")
I’ve been trying to get environment variables to work in 5.2.x, but no matter how I try to set them Logstash does not recognize them. I’ve tried setting up them up as permanent system environment variables, and I also t… --- ## [Elasticsearch filter plugin won't return failure tag](https://discuss.elastic.co/t/elasticsearch-filter-plugin-wont-return-failure-tag/96469)
**Author:** [@infamous](https://discuss.elastic.co/u/infamous)\ **Replies:** 0\ **Last updated:** [August 9, 2017, 3:51pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-wont-return-failure-tag/96469 "2017-08-09T15:51:50Z")
Hi all, I am using the elasticsearch filter plugin on 5.5 for a configuration and using the tag\_on\_failure option to do additional sorting. When does the tag\_on\_failure option trigger? I know it counts as a failure when… --- ## [Add new field from an old one \[Solved\]](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439)
**Author:** [@Chemse](https://discuss.elastic.co/u/Chemse)\ **Replies:** 1\ **Last updated:** [August 9, 2017, 3:30pm UTC](https://discuss.elastic.co/t/add-new-field-from-an-old-one-solved/96439 "2017-08-09T15:30:21Z")
Hello, I have the field Mat equal to: Mat = "07/07/2017-03:09:39 0235918 LEFER GUILLAUME Tps" and I did this but it doesn’t work mutate { split =\> { "Mat" =\> " " } remove\_field =\> \["Mat\[2\]","Mat\[2\]","Mat\[2\]"\] … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=927) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=929)