# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 943 --- ## [Converting PTR records to IP in logstash](https://discuss.elastic.co/t/converting-ptr-records-to-ip-in-logstash/93915)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 0\ **Last updated:** [July 20, 2017, 10:47am UTC](https://discuss.elastic.co/t/converting-ptr-records-to-ip-in-logstash/93915 "2017-07-20T10:47:12Z")
Hi , I am working with DNS query logs and I want the PTR record to change to the IP address. From : 4.3.2.1.in-addr.arpa to 1.2.3.4 I am trying to use ruby filter and add this information as a new field to the event… --- ## [Creating Array in Logstash](https://discuss.elastic.co/t/creating-array-in-logstash/93801)
**Author:** [@jacoblemperle](https://discuss.elastic.co/u/jacoblemperle)\ **Replies:** 3\ **Last updated:** [July 20, 2017, 10:28am UTC](https://discuss.elastic.co/t/creating-array-in-logstash/93801 "2017-07-20T10:28:49Z")
I am looking to create an array in Logstash right now with an object inside of it. Something that looks like this is what I am trying right now I am getting the error Ruby exception occurred: can't convert Array into S… --- ## [\_grokparsefailure even though the right patterns are there](https://discuss.elastic.co/t/-grokparsefailure-even-though-the-right-patterns-are-there/92153)
**Author:** [@DanMa](https://discuss.elastic.co/u/DanMa)\ **Replies:** 4\ **Last updated:** [July 20, 2017, 10:15am UTC](https://discuss.elastic.co/t/-grokparsefailure-even-though-the-right-patterns-are-there/92153 "2017-07-20T10:15:24Z")
Hey, iam trying to build a syslog solution for my firewall. I had built this two patterns: CISCOFW710006 %{WORD:protocol} (?:request|access) %{CISCO\_ACTION:action} from %{IP:src\_ip} to %{DATA:dst\_interface}:%{IP:ds… --- ## [Logstash : error when running](https://discuss.elastic.co/t/logstash-error-when-running/93728)
**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\ **Replies:** 6\ **Last updated:** [July 20, 2017, 10:10am UTC](https://discuss.elastic.co/t/logstash-error-when-running/93728 "2017-07-20T10:10:26Z")
Hello i jaust installed logsatsh-5.5.0 on my server then when i first tryed to run it by the command line bin/logstash -e 'input { stdin { } } output { stdout {} }' many errors appeared 2017-07-19 09:54:23,269 main ERR… --- ## [Logstash JDBC - Same input from multiple databases with one config](https://discuss.elastic.co/t/logstash-jdbc-same-input-from-multiple-databases-with-one-config/93900)
**Author:** [@tmoeller](https://discuss.elastic.co/u/tmoeller)\ **Replies:** 0\ **Last updated:** [July 20, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-jdbc-same-input-from-multiple-databases-with-one-config/93900 "2017-07-20T09:48:03Z")
Hi, is there a way to collect the same data from a number of databases with one central instance of logstash without blowing up the config file?? Today you have to provide a complete config for every host if i understa… --- ## [Where can I download the logstash-output-gelf](https://discuss.elastic.co/t/where-can-i-download-the-logstash-output-gelf/93315)
**Author:** [@David\_she](https://discuss.elastic.co/u/David_she)\ **Replies:** 2\ **Last updated:** [July 20, 2017, 9:05am UTC](https://discuss.elastic.co/t/where-can-i-download-the-logstash-output-gelf/93315 "2017-07-20T09:05:33Z")
Hi Sorry I need to manually install the logstash-output-gelf plugin and I can't find one for the life of me Any help? --- ## [Logstash install?](https://discuss.elastic.co/t/logstash-install/93660)
**Author:** [@Maha](https://discuss.elastic.co/u/Maha)\ **Replies:** 7\ **Last updated:** [July 20, 2017, 8:00am UTC](https://discuss.elastic.co/t/logstash-install/93660 "2017-07-20T08:00:29Z")
install logstash --- ## [Logstash Elastic Input Plugin Does Not Write @metadata](https://discuss.elastic.co/t/logstash-elastic-input-plugin-does-not-write-metadata/93613)
**Author:** [@Yoram\_Kornatzky](https://discuss.elastic.co/u/Yoram_Kornatzky)\ **Replies:** 2\ **Last updated:** [July 20, 2017, 7:50am UTC](https://discuss.elastic.co/t/logstash-elastic-input-plugin-does-not-write-metadata/93613 "2017-07-20T07:50:48Z")
Logstash 5.5 Elastic Search input plugin docinfo is true But no @metadata field in output. What could be the problem Here is the Logstash conf file: input { elasticsearch { hosts =\> "localhost:9… --- ## [Difficult log line](https://discuss.elastic.co/t/difficult-log-line/93706)
**Author:** [@Kubeksz](https://discuss.elastic.co/u/Kubeksz)\ **Replies:** 2\ **Last updated:** [July 20, 2017, 6:37am UTC](https://discuss.elastic.co/t/difficult-log-line/93706 "2017-07-20T06:37:01Z")
I'm a new user of ELK stack. I've got a little problem with filtering out specific section from my log. Sample log: \[2017-05-30 13:58:09,336\] INFO \[com.qwerty.test.core.services.impl.order.OrderEntryService (OrderEn… --- ## [How to make changing parameters in jdbc input?](https://discuss.elastic.co/t/how-to-make-changing-parameters-in-jdbc-input/93857)
**Author:** [@TaurusD](https://discuss.elastic.co/u/TaurusD)\ **Replies:** 0\ **Last updated:** [July 20, 2017, 2:56am UTC](https://discuss.elastic.co/t/how-to-make-changing-parameters-in-jdbc-input/93857 "2017-07-20T02:56:19Z")
Hi, I'm using jdbc input plugin to import tables from SQLServer 2012 to ELK. In my SQLServer DB, it will automatically generate a new table every minute with name XXXX\_yyyyMMddHHmm (e.g. Blablabla\_201707201023). Now I … --- ## [How to split a pure string like YYYYMMDDHHmm and convert into timestamp?](https://discuss.elastic.co/t/how-to-split-a-pure-string-like-yyyymmddhhmm-and-convert-into-timestamp/93379)
**Author:** [@TaurusD](https://discuss.elastic.co/u/TaurusD)\ **Replies:** 9\ **Last updated:** [July 20, 2017, 1:35am UTC](https://discuss.elastic.co/t/how-to-split-a-pure-string-like-yyyymmddhhmm-and-convert-into-timestamp/93379 "2017-07-20T01:35:57Z")
Hi, I'm currently using logstash to get some string which in a format of YYYYMMDDHHmm. That's a kind of pure "time" string which seems hardly to map by grok filter. I have searched solution for a long time but none of … --- ## [Custom logstash plugin installs and runs despite errors](https://discuss.elastic.co/t/custom-logstash-plugin-installs-and-runs-despite-errors/93850)
**Author:** [@chancerose91](https://discuss.elastic.co/u/chancerose91)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 11:53pm UTC](https://discuss.elastic.co/t/custom-logstash-plugin-installs-and-runs-despite-errors/93850 "2017-07-19T23:53:40Z")
I have been struggling to get started creating a custom LogStash plugin inside an air gaped environment. Today I made an interesting discovery. I am able to get a custom plugin to install and run successfully even though… --- ## [JSON Array using Logstash](https://discuss.elastic.co/t/json-array-using-logstash/93088)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 20\ **Last updated:** [July 19, 2017, 9:47pm UTC](https://discuss.elastic.co/t/json-array-using-logstash/93088 "2017-07-19T21:47:40Z")
I am fetching data from SQL Server using Log stash. JDBC Rivers would convert columns with "." notation to Array structures. I am looking for a similar way in Log stash. I am using the logstash-filter-aggregate pluggin… --- ## [How to uninstall non-plugin gems from Logstash?](https://discuss.elastic.co/t/how-to-uninstall-non-plugin-gems-from-logstash/93837)
**Author:** [@jakinov](https://discuss.elastic.co/u/jakinov)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 8:21pm UTC](https://discuss.elastic.co/t/how-to-uninstall-non-plugin-gems-from-logstash/93837 "2017-07-19T20:21:37Z")
how do I uninstall non-plugin gems from Logtash? Is there a cleaner way besides manually going in and deleting the folders and files and editing the Gemspec? --- ## [Logstash redis input plugin how to add pattern\_channel to message](https://discuss.elastic.co/t/logstash-redis-input-plugin-how-to-add-pattern-channel-to-message/93116)
**Author:** [@2f905b6636d57c27fbe8](https://discuss.elastic.co/u/2f905b6636d57c27fbe8)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 6:18pm UTC](https://discuss.elastic.co/t/logstash-redis-input-plugin-how-to-add-pattern-channel-to-message/93116 "2017-07-19T18:18:52Z")
Hey Guys, We have logstash using redis input plugin, and use pattner\_channel to match multiple channels, how to get the info to the either event or message. I see people post same question and use add\_field, but thos… --- ## [Rfc3195 compliance - Beep messages](https://discuss.elastic.co/t/rfc3195-compliance-beep-messages/93335)
**Author:** [@Francis\_Claessens](https://discuss.elastic.co/u/Francis_Claessens)\ **Replies:** 4\ **Last updated:** [July 19, 2017, 6:06pm UTC](https://discuss.elastic.co/t/rfc3195-compliance-beep-messages/93335 "2017-07-19T18:06:00Z")
Hi everybody, Does anybody of you know how to handle beep messages stated in RFC3195 for reliable syslog over TCP? I am receiving these messages in logstash, but don't know how to let logstash react to the sender of th… --- ## [Error parsing json in Logstash](https://discuss.elastic.co/t/error-parsing-json-in-logstash/93813)
**Author:** [@camarar](https://discuss.elastic.co/u/camarar)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 5:55pm UTC](https://discuss.elastic.co/t/error-parsing-json-in-logstash/93813 "2017-07-19T17:55:36Z")
Dear, I would like receive help to solve my problem... I have this error for all event: exception=\>#\ **Author:** [@ramzi](https://discuss.elastic.co/u/ramzi)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 5:11pm UTC](https://discuss.elastic.co/t/help-grok-filter-unstructured-data/93816 "2017-07-19T17:11:11Z") Hello guys , i'm a beginner in this ELK, i'm facing a little problem and i would really appreciate some help from you ,so i have a WAF log file with some non structured content and i want to parse it and extract few inf… --- ## [Logstash keeps restarting with x-pack](https://discuss.elastic.co/t/logstash-keeps-restarting-with-x-pack/93814)
**Author:** [@jake\_l](https://discuss.elastic.co/u/jake_l)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 5:01pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-with-x-pack/93814 "2017-07-19T17:01:00Z")
Hello everyone! My team and I are new to x-pack and the elastic stack in general. We are currently trying to deploy a new elastic stack with x-pack enabled and we are having an issue with logstash continually restarting.… --- ## [Logstash 5.3 webhdfs output plugin exception access violation](https://discuss.elastic.co/t/logstash-5-3-webhdfs-output-plugin-exception-access-violation/93734)
**Author:** [@phred](https://discuss.elastic.co/u/phred)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 9:40am UTC](https://discuss.elastic.co/t/logstash-5-3-webhdfs-output-plugin-exception-access-violation/93734 "2017-07-19T09:40:30Z")
Hi, I created a simple logstash pipeline on Windows with a stdin and a webhdfs output (with kerberos gssapi and a keytab) and I am able to send a message which is received and stored properly by the hdfs namenode. But … --- ## [I need help in extracting specific value from json array field](https://discuss.elastic.co/t/i-need-help-in-extracting-specific-value-from-json-array-field/93751)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 3:48pm UTC](https://discuss.elastic.co/t/i-need-help-in-extracting-specific-value-from-json-array-field/93751 "2017-07-19T15:48:54Z")
Hi guys, I'm working on a json log. I have extracted correctly json message from its entries and parsed it via json plugin in this way: grok { patterns\_dir =\> \["/home/elastic/ELASTIC\_55/logstash-5.5.0/config/patterns… --- ## [Logstash GROK If statement](https://discuss.elastic.co/t/logstash-grok-if-statement/93768)
**Author:** [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-grok-if-statement/93768 "2017-07-19T15:09:54Z")
Hi, I am trying to configure logstash and below is my filter configuration . Capturing event in grok statement and then checking whether event is equal to condition but i am getting errors at if\[event\]= is it poss… --- ## [Logstash proposal](https://discuss.elastic.co/t/logstash-proposal/93794)
**Author:** [@R-Ali](https://discuss.elastic.co/u/R-Ali)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 3:02pm UTC](https://discuss.elastic.co/t/logstash-proposal/93794 "2017-07-19T15:02:36Z")
Hello, @Elastic Team : Can you please add this parameter in the new version of logstash. log.filename This parameter will be used to dynamize the names of log files. in ../logstash-5.5.0/logstash-core/lib/logstas… --- ## [Logstash stopped pushing logs to elastic(UPD)](https://discuss.elastic.co/t/logstash-stopped-pushing-logs-to-elastic-upd/93397)
**Author:** [@maslenkov](https://discuss.elastic.co/u/maslenkov)\ **Replies:** 4\ **Last updated:** [July 19, 2017, 12:46pm UTC](https://discuss.elastic.co/t/logstash-stopped-pushing-logs-to-elastic-upd/93397 "2017-07-19T12:46:20Z")
Hey friends! My question about ELK stack. I have remote rails server. It writes two logs - production.log and reports.log. Also I didn't remove ELK's server syslog from my logstash input. So my logstash has to parse loca… --- ## [Logstash changes original @timestamp value received from filebeat](https://discuss.elastic.co/t/logstash-changes-original-timestamp-value-received-from-filebeat/93551)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 6\ **Last updated:** [July 19, 2017, 11:25am UTC](https://discuss.elastic.co/t/logstash-changes-original-timestamp-value-received-from-filebeat/93551 "2017-07-19T11:25:03Z")
Hi Guys, I noticed that @timestamp field, which is correctly defined by filebeat, is changed automatically by logstash and its value is replaced with a log timestamp value (field name is a\_timestamp). Here is part of lo… --- ## [Duplication of records in ELK from Kafka](https://discuss.elastic.co/t/duplication-of-records-in-elk-from-kafka/93739)
**Author:** [@b2ron](https://discuss.elastic.co/u/b2ron)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 10:41am UTC](https://discuss.elastic.co/t/duplication-of-records-in-elk-from-kafka/93739 "2017-07-19T10:41:52Z")
CentOS release 6.9 logstash 5.3.3-1 java version "1.8.0\_92" Kafka - 2.11-0.11.0.0 I have a few hosts with logs. from these hosts filebeat logs to Kafka cat /etc/filebeat/filebeat.yml filebeat: prospectors: # cont… --- ## [Logstash loses records on 500 status code](https://discuss.elastic.co/t/logstash-loses-records-on-500-status-code/93727)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 9:07am UTC](https://discuss.elastic.co/t/logstash-loses-records-on-500-status-code/93727 "2017-07-19T09:07:25Z")
One of the ES nodes in our cluster crashed today, and while the cluster kept functioning some of the bulk insert requests performed by logstash failed with the below error: \[2017-07-19T04:47:46,560\]\[WARN \]\[logstash.out… --- ## [High CPU Usage by logstash processes](https://discuss.elastic.co/t/high-cpu-usage-by-logstash-processes/93697)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [July 19, 2017, 7:51am UTC](https://discuss.elastic.co/t/high-cpu-usage-by-logstash-processes/93697 "2017-07-19T07:51:56Z")
When the logstash process is consuming high CPU cycles and CPU usage shoots up to more than 100%. The server is a 2 core machine. The standard GROK filters have been used to process the log files. There are 3 set of GROK… --- ## [Logstash's own log conf - log4j with syslog appender](https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715)
**Author:** [@randude](https://discuss.elastic.co/u/randude)\ **Replies:** 0\ **Last updated:** [July 19, 2017, 8:09am UTC](https://discuss.elastic.co/t/logstashs-own-log-conf-log4j-with-syslog-appender/93715 "2017-07-19T08:09:51Z")
Hi, I'm trying to send Logstash's own log to my rsyslog process. I'm using the conf below. Logstash does indeed send log data to my rsyslog process but it uses default settings and basically just ignores my custom settin… --- ## [Ship audit log entries retrieved via REST](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615)
**Author:** [@Adam\_Szabo](https://discuss.elastic.co/u/Adam_Szabo)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 7:05am UTC](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615 "2017-07-19T07:05:00Z")
Confluence's audit log is only available via the management UI REST What would be a good solution to ship these entries to Elasticsearch? I had a look at the http\_poller input plugin. While it looks like a good ca… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=941) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=943)