# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=943 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 944 --- ## [How to append an existing filed to another existing filed](https://discuss.elastic.co/t/how-to-append-an-existing-filed-to-another-existing-filed/93652)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 6:50pm UTC](https://discuss.elastic.co/t/how-to-append-an-existing-filed-to-another-existing-filed/93652 "2017-07-18T18:50:04Z")
Hi there! How to append an existing filed to an another existing filed? In kibana, I have like this deviceId : 1,002 level : INFO sessionId : EC142 logmessage: Workflow has completed with bulkdata So, now I want… --- ## [Logstash HTTP plugin details](https://discuss.elastic.co/t/logstash-http-plugin-details/93439)
**Author:** [@Bob04](https://discuss.elastic.co/u/Bob04)\ **Replies:** 5\ **Last updated:** [July 18, 2017, 6:25pm UTC](https://discuss.elastic.co/t/logstash-http-plugin-details/93439 "2017-07-18T18:25:34Z")
I have a question about Logstash http input plugin: What is the format of URL for sending POST request to Logstash so Logstash can receive JSON message via http plugin? Is it something like this: server\_name:tcp\_port… --- ## [What type of syslog format is this and how should I parse it?](https://discuss.elastic.co/t/what-type-of-syslog-format-is-this-and-how-should-i-parse-it/93481)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 3\ **Last updated:** [July 18, 2017, 5:25pm UTC](https://discuss.elastic.co/t/what-type-of-syslog-format-is-this-and-how-should-i-parse-it/93481 "2017-07-18T17:25:36Z")
I have logstash configured like so: input { beats { port =\> "9998" type =\> syslog } tcp { port =\> "9999" type =\> syslog } udp { port =\> "9999" type =\> syslog } .... if \[type\] == "s… --- ## [Logstash 5 stops event output after some time](https://discuss.elastic.co/t/logstash-5-stops-event-output-after-some-time/93407)
**Author:** [@Joaquim\_Freitas](https://discuss.elastic.co/u/Joaquim_Freitas)\ **Replies:** 3\ **Last updated:** [July 18, 2017, 4:40pm UTC](https://discuss.elastic.co/t/logstash-5-stops-event-output-after-some-time/93407 "2017-07-18T16:40:04Z")
Hi everyone, I'm struggling with a strange problem with a Logstash 5 that I'm running on a Windows 2012 x64.... Logstash seems to miss the output of some events, or sometimes it stops outputting events entirely. My L… --- ## [JDBC input plugin - no results from oracle db](https://discuss.elastic.co/t/jdbc-input-plugin-no-results-from-oracle-db/93567)
**Author:** [@mato848](https://discuss.elastic.co/u/mato848)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 2:24pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-no-results-from-oracle-db/93567 "2017-07-18T14:24:35Z")
Hi everyone, I am trying to read some data from Oracle 11g database. My configuration is working, but only until some id. For example following statement produces results into output select \* from sys\_log where id \> … --- ## [Logstash not receiving messages](https://discuss.elastic.co/t/logstash-not-receiving-messages/93370)
**Author:** [@Aleksandar\_Aleksandr](https://discuss.elastic.co/u/Aleksandar_Aleksandr)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 2:19pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-messages/93370 "2017-07-18T14:19:45Z")
Hello, I am trying to get the ELK up and running on docker. I have succesfully integrated the three services and they do in fact communicate with each other. My problem arises when I am trying to send messages to logst… --- ## [Dynamic Urls for http Outbound Plugin in logstash config](https://discuss.elastic.co/t/dynamic-urls-for-http-outbound-plugin-in-logstash-config/93423)
**Author:** [@RakeshOngolu](https://discuss.elastic.co/u/RakeshOngolu)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 2:14pm UTC](https://discuss.elastic.co/t/dynamic-urls-for-http-outbound-plugin-in-logstash-config/93423 "2017-07-18T14:14:14Z")
Hello everyone, I just want to use http inbound and outbound plugins for asynchronous communication between two applications(host & target). The data (json)from http inbound plugin contains the url to be used in http o… --- ## [Dropping characters from a field](https://discuss.elastic.co/t/dropping-characters-from-a-field/93426)
**Author:** [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 2:13pm UTC](https://discuss.elastic.co/t/dropping-characters-from-a-field/93426 "2017-07-18T14:13:26Z")
I have a field called usp which is mapped to what is supposed to be a URL but due to my kv filters renders it as see below I want to remove the // using kv. --- ## [Date filter - Timezone error](https://discuss.elastic.co/t/date-filter-timezone-error/93465)
**Author:** [@sslv](https://discuss.elastic.co/u/sslv)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 2:10pm UTC](https://discuss.elastic.co/t/date-filter-timezone-error/93465 "2017-07-18T14:10:14Z")
Hi, I have the following date filter: date { timezone =\> "America/Los\_Angeles" match =\> \["logtime", "M/dd/YYYY HH:mm:ss a"\] } input is : 6/30/2017 11:00:00 PM And the expected output is: 2017-07-… --- ## [@timestamp cannot be deleted - overwriting does not work](https://discuss.elastic.co/t/timestamp-cannot-be-deleted-overwriting-does-not-work/93512)
**Author:** [@dschmitz](https://discuss.elastic.co/u/dschmitz)\ **Replies:** 5\ **Last updated:** [July 18, 2017, 1:57pm UTC](https://discuss.elastic.co/t/timestamp-cannot-be-deleted-overwriting-does-not-work/93512 "2017-07-18T13:57:52Z")
Hi, I know, that the field @timestamp can not be deleted. So I want to override @timestamp with the timestamp of logs. I've created a new field. The timestamp in logfile looks like "13.07.2017 07:11:10 ..." my new field … --- ## [Logstash Logging](https://discuss.elastic.co/t/logstash-logging/92828)
**Author:** [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\ **Replies:** 6\ **Last updated:** [July 18, 2017, 1:44pm UTC](https://discuss.elastic.co/t/logstash-logging/92828 "2017-07-18T13:44:27Z")
HI , i am trying to enable logging in Logstash . i am using windows version on my desktop Start command logstash.bat -f beats.conf --verbose logstash-5.3.1\\config\\logstash.yml log.level: debug path.logs: C:\\Users\\A… --- ## [How to write this equation in LogStash lat = lat\_min + (Y \* lat\_range / y\_range) long = long\_min + (X \* long\_range / x\_range)](https://discuss.elastic.co/t/how-to-write-this-equation-in-logstash-lat-lat-min-y-lat-range-y-range-long-long-min-x-long-range-x-range/93572)
**Author:** [@Alex\_S](https://discuss.elastic.co/u/Alex_S)\ **Replies:** 4\ **Last updated:** [July 18, 2017, 12:21pm UTC](https://discuss.elastic.co/t/how-to-write-this-equation-in-logstash-lat-lat-min-y-lat-range-y-range-long-long-min-x-long-range-x-range/93572 "2017-07-18T12:21:43Z")
Hello Geeks , I have a formula I want to write into LogStash but I don't know the syntax lat = lat\_min + (Y \* lat\_range / y\_range) long = long\_min + (X \* long\_range / x\_range) Thanks :)) --- ## [\_jsonparsefailure with basic json input](https://discuss.elastic.co/t/-jsonparsefailure-with-basic-json-input/93550)
**Author:** [@Charlotte\_EGM](https://discuss.elastic.co/u/Charlotte_EGM)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 10:45am UTC](https://discuss.elastic.co/t/-jsonparsefailure-with-basic-json-input/93550 "2017-07-18T10:45:40Z")
Hi, I have a \_jsonparsefailure when receiving json message like this : {"subscriptionId":"596db6409dd2c052b0ca6e2b", "data":{"id":"Sensor8", "type":"SensingDevice", "AZO":{"type":"Number","value":-1… --- ## [Base Pattern & optional patterns parsing with logstash](https://discuss.elastic.co/t/base-pattern-optional-patterns-parsing-with-logstash/93351)
**Author:** [@MaikLinnemann](https://discuss.elastic.co/u/MaikLinnemann)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 9:32am UTC](https://discuss.elastic.co/t/base-pattern-optional-patterns-parsing-with-logstash/93351 "2017-07-18T09:32:41Z")
Dear Forum, i have a problem with parsing grok filter. This is working from command line with a ruby test script like it should: pattern = "%{PFLTR},?%{PORTS}?,?%{ICMP}?" It parses the lines and gets the stuff fro… --- ## [Logstash input S3 for a on-premises S3](https://discuss.elastic.co/t/logstash-input-s3-for-a-on-premises-s3/93520)
**Author:** [@rubick](https://discuss.elastic.co/u/rubick)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 8:44am UTC](https://discuss.elastic.co/t/logstash-input-s3-for-a-on-premises-s3/93520 "2017-07-18T08:44:21Z")
I would like to know if it's possible to configure Logstash S3 input to a on-premises S3. I have seen that I can only configure the region but nothing about http endpoint Is it possible to read from a custom S3? --- ## [Parsing two information with one filter](https://discuss.elastic.co/t/parsing-two-information-with-one-filter/93516)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 8:21am UTC](https://discuss.elastic.co/t/parsing-two-information-with-one-filter/93516 "2017-07-18T08:21:21Z")
Hello everyone, I need your help to parse with grok filter two information in two different variable with one filter. The log line is as follows : From: DNS\_dns\[2060\]/15885 the first information is : DNS\_dns an… --- ## [How to store shingle tokens to data fields of a document?](https://discuss.elastic.co/t/how-to-store-shingle-tokens-to-data-fields-of-a-document/93484)
**Author:** [@kmin93](https://discuss.elastic.co/u/kmin93)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 3:47am UTC](https://discuss.elastic.co/t/how-to-store-shingle-tokens-to-data-fields-of-a-document/93484 "2017-07-18T03:47:20Z")
I've been searching for a way to append tokens created by the shingle token filter to field data as it's being parsed into Logstash. All the documentation I've found so far mainly deals with how to use the shingle token … --- ## [Timestamp replace not working](https://discuss.elastic.co/t/timestamp-replace-not-working/93350)
**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\ **Replies:** 8\ **Last updated:** [July 18, 2017, 7:34am UTC](https://discuss.elastic.co/t/timestamp-replace-not-working/93350 "2017-07-18T07:34:03Z")
Hi, I understand this might be a very common question asked but I couldn't find any answer that addressed my issue. Here it goes. I have a log message as shown below that I am publishing from Filebeats into Logstash. 2… --- ## [Code doesn't get executed](https://discuss.elastic.co/t/code-doesnt-get-executed/93435)
**Author:** [@mahsa\_b](https://discuss.elastic.co/u/mahsa_b)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 7:00pm UTC](https://discuss.elastic.co/t/code-doesnt-get-executed/93435 "2017-07-17T19:00:44Z")
Hi , I have a block of code like this: if "vlan" in \[tags\] { grok { patterns\_dir =\> \["./patterns/custom-patterns"\] match =\> { "message" =\> \["configure vlan %{WORD:vlan} add ports %{PORTS:ports} %{TAG\_IN… --- ## [How to check, if a hash is empty (no keys)](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227)
**Author:** [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\ **Replies:** 4\ **Last updated:** [July 17, 2017, 1:55pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227 "2017-07-17T13:55:38Z")
I tried to use the same method as for arrays for a hash, that in our case could some times be empty: if \[geoip\] == \[\] { mutate { remove\_field =\> \["geoip"\] } } Unfortunately, the check i… --- ## [Sending @metadata from logstash to elastic search](https://discuss.elastic.co/t/sending-metadata-from-logstash-to-elastic-search/92890)
**Author:** [@darraghjones](https://discuss.elastic.co/u/darraghjones)\ **Replies:** 4\ **Last updated:** [July 17, 2017, 3:15pm UTC](https://discuss.elastic.co/t/sending-metadata-from-logstash-to-elastic-search/92890 "2017-07-17T15:15:08Z")
I've got the following logstash config, and I'm trying to send the RabbitMQ headers (which are stored in the @metadata field) to ElasticSearch input { rabbitmq { auto\_delete =\> false durable =\> fals… --- ## [Use DB-IP database instead of Maxmind database to get GEOIP values](https://discuss.elastic.co/t/use-db-ip-database-instead-of-maxmind-database-to-get-geoip-values/93411)
**Author:** [@Krisztian\_Vasko](https://discuss.elastic.co/u/Krisztian_Vasko)\ **Replies:** 0\ **Last updated:** [July 17, 2017, 2:45pm UTC](https://discuss.elastic.co/t/use-db-ip-database-instead-of-maxmind-database-to-get-geoip-values/93411 "2017-07-17T14:45:15Z")
I am using the geoip location mapping in Logstash configuration. Everything is working fine but it seems that many times I am getting wrong values in geoip.location filed. There are approx. 40-50km difference. I have fou… --- ## [When Logstash sends ACK to input source(Example- Filebeat)](https://discuss.elastic.co/t/when-logstash-sends-ack-to-input-source-example-filebeat/93147)
**Author:** [@prashant.bajpai](https://discuss.elastic.co/u/prashant.bajpai)\ **Replies:** 2\ **Last updated:** [July 17, 2017, 11:46am UTC](https://discuss.elastic.co/t/when-logstash-sends-ack-to-input-source-example-filebeat/93147 "2017-07-17T11:46:16Z")
I have read about the at-least-once-delivery commitment of filebeat and what I understood is that until the ack of sent logline is not received by filebeat, that line will be sent again (in case of filebeat re-start). N… --- ## [Logstash log4j2.properties gets overriden by dpkg](https://discuss.elastic.co/t/logstash-log4j2-properties-gets-overriden-by-dpkg/90290)
**Author:** [@ol3k](https://discuss.elastic.co/u/ol3k)\ **Replies:** 5\ **Last updated:** [July 17, 2017, 8:47am UTC](https://discuss.elastic.co/t/logstash-log4j2-properties-gets-overriden-by-dpkg/90290 "2017-07-17T08:47:10Z")
I've a problem with my custom log4j2.properties file: While the elasticsearch config is changed to log4j2.properties.dpkg-new, the logstash properties file gets overriden by the paket manager each time I update logstas… --- ## [How to parse custom logs with nested jsons](https://discuss.elastic.co/t/how-to-parse-custom-logs-with-nested-jsons/93349)
**Author:** [@pijain](https://discuss.elastic.co/u/pijain)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 7:38am UTC](https://discuss.elastic.co/t/how-to-parse-custom-logs-with-nested-jsons/93349 "2017-07-17T07:38:51Z")
How to parse the log files as below 2017-07-09 18:42:53,748 || \[INFO\] || default || || some\_text || some\_text || /path/to/some/python/file.py || 919 || {"key1": "value1", "key2": {"key3": "value3", "key4": "value4", "… --- ## [Json logstash](https://discuss.elastic.co/t/json-logstash/93331)
**Author:** [@ahongyun](https://discuss.elastic.co/u/ahongyun)\ **Replies:** 5\ **Last updated:** [July 17, 2017, 7:12am UTC](https://discuss.elastic.co/t/json-logstash/93331 "2017-07-17T07:12:21Z")
Hi all i have a json file and im trying to parse this thru logstash and into elasticsearch and kibana. I have the following config. input { file { path =\> "/appdir/logs/batch-timing.json" type =\> "dbatch"… --- ## [File-input , how to add file offset as a new field](https://discuss.elastic.co/t/file-input-how-to-add-file-offset-as-a-new-field/93323)
**Author:** [@Ryan\_Qian](https://discuss.elastic.co/u/Ryan_Qian)\ **Replies:** 2\ **Last updated:** [July 17, 2017, 5:41am UTC](https://discuss.elastic.co/t/file-input-how-to-add-file-offset-as-a-new-field/93323 "2017-07-17T05:41:22Z")
I have smillar question as this one, need the offset to maintain the log order (which logs happen at same timestamp) Thanks --- ## [How to send syslogs to logstash](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 2\ **Last updated:** [July 17, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-send-syslogs-to-logstash/93244 "2017-07-17T05:35:45Z")
I want to send syslog data to logstash. I'm trying to do this with the beats Syslog Output Plugin. filebeat config: filebeat: prospectors: - paths: - /var/log/messages - /var/log/audit/… --- ## [Not able to ingest data into Elastic Endpoint using Logstash (Using logstash On Windows)](https://discuss.elastic.co/t/not-able-to-ingest-data-into-elastic-endpoint-using-logstash-using-logstash-on-windows/93317)
**Author:** [@Rakshith\_Rangaswamy](https://discuss.elastic.co/u/Rakshith_Rangaswamy)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 2:23am UTC](https://discuss.elastic.co/t/not-able-to-ingest-data-into-elastic-endpoint-using-logstash-using-logstash-on-windows/93317 "2017-07-17T02:23:21Z")
Hi, I am trying to ingest data into elasticsearch using logstash (on Windows OS) by following the example present here: However, I still see No Monitoring Data Found on the Kibana page. The following is the samp… --- ## [No config files found in path after 2-3 days uptime](https://discuss.elastic.co/t/no-config-files-found-in-path-after-2-3-days-uptime/93100)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 5\ **Last updated:** [July 17, 2017, 1:28am UTC](https://discuss.elastic.co/t/no-config-files-found-in-path-after-2-3-days-uptime/93100 "2017-07-17T01:28:18Z")
I'm using Elastic stack 5.5, OS Centos 7 and testing with x-pack. My logstash start normaly, no problem when started. But after 2-3 days update, i got error and logstash can't send data. \[2017-07-14T08:31:39,747\]\[INFO… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=942) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=944)