# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=945 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 946 --- ## [Does not retry failed http output](https://discuss.elastic.co/t/does-not-retry-failed-http-output/93129)
**Author:** [@giannisapi](https://discuss.elastic.co/u/giannisapi)\ **Replies:** 0\ **Last updated:** [July 14, 2017, 6:54am UTC](https://discuss.elastic.co/t/does-not-retry-failed-http-output/93129 "2017-07-14T06:54:49Z")
Hi All, I have version of logstash 5.1.1 and it seems that when my application is down, http output does not retry to push the failed messages. According to my understanding of : Logstash input should stop feeding me… --- ## [Finding most frequently accessed URI-paths / Transactions using Logstash](https://discuss.elastic.co/t/finding-most-frequently-accessed-uri-paths-transactions-using-logstash/92644)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 3\ **Last updated:** [July 14, 2017, 6:41am UTC](https://discuss.elastic.co/t/finding-most-frequently-accessed-uri-paths-transactions-using-logstash/92644 "2017-07-14T06:41:31Z")
Hi, My log file looks like this: 2015-06-12:00:08:54 100.220.144.1 GET /site/path1.aspx 200 2015-06-12:00:08:55 100.220.144.1 GET /site/path2.aspx 200 2015-06-12:00:08:56 100.220.144.1 GET /site/path3.aspx 200 2015… --- ## [Logstash redis input thread duplicate message](https://discuss.elastic.co/t/logstash-redis-input-thread-duplicate-message/93117)
**Author:** [@2f905b6636d57c27fbe8](https://discuss.elastic.co/u/2f905b6636d57c27fbe8)\ **Replies:** 0\ **Last updated:** [July 14, 2017, 6:04am UTC](https://discuss.elastic.co/t/logstash-redis-input-thread-duplicate-message/93117 "2017-07-14T06:04:59Z")
Looks like when change redis input plugin threads, it duplicate message exactly the same n times this is in the redis-cli, only 1 record redis-cli -h 127.0.0.1 PSUBSCRIBE ssh | grep 58.218.198.142 2017-07-14T05:57:… --- ## [Pushing flush onto pipeline in logs](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-in-logs/92341)
**Author:** [@Romain\_Pelissier](https://discuss.elastic.co/u/Romain_Pelissier)\ **Replies:** 7\ **Last updated:** [July 14, 2017, 2:10am UTC](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-in-logs/92341 "2017-07-14T02:10:28Z")
Hi all! I hope someone could help me because I dig the entire internet without finding a solution.. Here we are: I have a filebeat agent running on pfsense 2.3.x ( filebeat version 6.0.0-alpha3-git877f311 (amd64), libbea… --- ## [Json parse breaks with TCP input](https://discuss.elastic.co/t/json-parse-breaks-with-tcp-input/88129)
**Author:** [@jigar4u2](https://discuss.elastic.co/u/jigar4u2)\ **Replies:** 7\ **Last updated:** [July 13, 2017, 10:32pm UTC](https://discuss.elastic.co/t/json-parse-breaks-with-tcp-input/88129 "2017-07-13T22:32:17Z")
I tried test.config with 'stdin' input which works fine, but when I change to 'tcp' input which I use with nxlog for other logs breaks...what I am missing? Works: input { stdin { codec =\> mult… --- ## [Logstash 5.5 and elasticsearch 1.7.6](https://discuss.elastic.co/t/logstash-5-5-and-elasticsearch-1-7-6/93045)
**Author:** [@panaman](https://discuss.elastic.co/u/panaman)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 9:30pm UTC](https://discuss.elastic.co/t/logstash-5-5-and-elasticsearch-1-7-6/93045 "2017-07-13T21:30:44Z")
I am in the process of upgrading our elastic stack. I wanting to upgrade logstash first. Can logstash 5.5 output to elasticsearch 1.7.6 and is there any gotchas i should worry about? --- ## [Logstash dropping events not accepting connections](https://discuss.elastic.co/t/logstash-dropping-events-not-accepting-connections/92399)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 8:59pm UTC](https://discuss.elastic.co/t/logstash-dropping-events-not-accepting-connections/92399 "2017-07-13T20:59:42Z")
I have a ELK box that is processing around 240 events per second and sending to Elasticsearch and Graphite. At times when I'm trying to do a query in Kibana that takes a bit of searching, logstash will start dropping e… --- ## [Grok Filter not extracting the fields](https://discuss.elastic.co/t/grok-filter-not-extracting-the-fields/92822)
**Author:** [@birdman](https://discuss.elastic.co/u/birdman)\ **Replies:** 7\ **Last updated:** [July 13, 2017, 8:10pm UTC](https://discuss.elastic.co/t/grok-filter-not-extracting-the-fields/92822 "2017-07-13T20:10:09Z")
Hey, My grok filter is working but not extracting and here is the logstash.conf input { beats { port =\> 5044 } } filter { if \[type\] == "iis" { if \[message\] =~ "^#" { … --- ## [Groks for parsing Windows and Redhat syslogs](https://discuss.elastic.co/t/groks-for-parsing-windows-and-redhat-syslogs/93071)
**Author:** [@CDR](https://discuss.elastic.co/u/CDR)\ **Replies:** 1\ **Last updated:** [July 13, 2017, 7:16pm UTC](https://discuss.elastic.co/t/groks-for-parsing-windows-and-redhat-syslogs/93071 "2017-07-13T19:16:29Z")
I am currently trying to parse syslog messages coming from Windows OS and Redhat. Obviously this has been done before by a lot of people. I was wondering if there was a website or if someone could point me to a location… --- ## [Create a new field by extracting data from two existing fields in Logstash](https://discuss.elastic.co/t/create-a-new-field-by-extracting-data-from-two-existing-fields-in-logstash/93054)
**Author:** [@saifhitawala](https://discuss.elastic.co/u/saifhitawala)\ **Replies:** 1\ **Last updated:** [July 13, 2017, 7:15pm UTC](https://discuss.elastic.co/t/create-a-new-field-by-extracting-data-from-two-existing-fields-in-logstash/93054 "2017-07-13T19:15:34Z")
I have created two fields from my logs as shown below: names: "LeBron", "Jordan", "Philips", "Samuel" threepointers: "100", "100", "90", "50" names and threepointers are both of type string. This data has already been… --- ## [Different inputs logs with logstash](https://discuss.elastic.co/t/different-inputs-logs-with-logstash/93068)
**Author:** [@cazyfunlover](https://discuss.elastic.co/u/cazyfunlover)\ **Replies:** 6\ **Last updated:** [July 13, 2017, 7:15pm UTC](https://discuss.elastic.co/t/different-inputs-logs-with-logstash/93068 "2017-07-13T19:15:22Z")
I am trying to parse different logs with logstash . Right now i have only one log file coming from multiple servers at logstash . Parsing working OK . But i am planning to add multiple logs ( syslogs , apache , windows… --- ## [Grok pattern won't match](https://discuss.elastic.co/t/grok-pattern-wont-match/93059)
**Author:** [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Replies:** 1\ **Last updated:** [July 13, 2017, 5:46pm UTC](https://discuss.elastic.co/t/grok-pattern-wont-match/93059 "2017-07-13T17:46:19Z")
I have this pattern: 2017-07-13T00:00:04,621 \[WARN \]\[Client-Push:1:3\]\[PfFwdPointSubscriptionService\] SEKHKD is disabled I am able to match up to \[client push1:3\] Using this: \\A%{TIMESTAMP\_ISO8601:timestamp}\\s+\[%{LOGLEV… --- ## [Can we combine 2 codec in input plugin like multiline with gzip\_lines?](https://discuss.elastic.co/t/can-we-combine-2-codec-in-input-plugin-like-multiline-with-gzip-lines/92706)
**Author:** [@g\_dev](https://discuss.elastic.co/u/g_dev)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 5:09pm UTC](https://discuss.elastic.co/t/can-we-combine-2-codec-in-input-plugin-like-multiline-with-gzip-lines/92706 "2017-07-13T17:09:36Z")
I want to extraxt a .zip files using gzip\_lines and then want to parse files inside using multiline codec. So can we combine 2 codec in input plugin like multiline with gzip\_lines? --- ## [How to deal with duplicate fields in a message](https://discuss.elastic.co/t/how-to-deal-with-duplicate-fields-in-a-message/92790)
**Author:** [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 4:39pm UTC](https://discuss.elastic.co/t/how-to-deal-with-duplicate-fields-in-a-message/92790 "2017-07-13T16:39:15Z")
Hi Guys, for swap transactions there are usually 2 legs. Unfortunately the application spews everything out and doesn't give the legs any distinct name so I end up with the value for both legs of the transaction duplica… --- ## [Deleting post](https://discuss.elastic.co/t/deleting-post/92854)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 6\ **Last updated:** [July 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/deleting-post/92854 "2017-07-13T16:10:57Z")
Deleting this post --- ## [Support for Graphite Events?](https://discuss.elastic.co/t/support-for-graphite-events/93047)
**Author:** [@astickler](https://discuss.elastic.co/u/astickler)\ **Replies:** 0\ **Last updated:** [July 13, 2017, 3:09pm UTC](https://discuss.elastic.co/t/support-for-graphite-events/93047 "2017-07-13T15:09:53Z")
Hi - is it possible to populate Graphite Events (rather than time-series metrics) from logstash, if so, is there an example please? Thanks, Andrew --- ## [How to add field using Environment plugin in Logstash configuration file](https://discuss.elastic.co/t/how-to-add-field-using-environment-plugin-in-logstash-configuration-file/92717)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 3\ **Last updated:** [July 13, 2017, 3:05pm UTC](https://discuss.elastic.co/t/how-to-add-field-using-environment-plugin-in-logstash-configuration-file/92717 "2017-07-13T15:05:48Z")
Question: How to add field from Environment plugin in logstash config file. Here is my Config file input{ stdin{ } } filter { if "exception" not in \[tags\] { # example output: # 2016-12-16 20:43:20,535 DEBU… --- ## [Logstash 5.5.0 NameError: undefined local variable or method \`dotfile' for #\ **Author:** [@dawncold](https://discuss.elastic.co/u/dawncold)\ **Replies:** 1\ **Last updated:** [July 13, 2017, 3:00pm UTC](https://discuss.elastic.co/t/logstash-5-5-0-nameerror-undefined-local-variable-or-method-dotfile-for-awesomeprint-inspector/92923 "2017-07-13T15:00:16Z") my logstash output config output { stdout { codec =\> rubydebug } if "\_jsonparsefailure" not in \[tags\] { elasticsearch { } } } logstash 5.5.0 raised an error: NameError: undefined local variab… --- ## [LS 5.5.0 plugin, 'geoip' installed; errors with: "Couldn't find any filter plugin named 'geoip'"](https://discuss.elastic.co/t/ls-5-5-0-plugin-geoip-installed-errors-with-couldnt-find-any-filter-plugin-named-geoip/93033)
**Author:** [@dev\_null](https://discuss.elastic.co/u/dev_null)\ **Replies:** 0\ **Last updated:** [July 13, 2017, 2:29pm UTC](https://discuss.elastic.co/t/ls-5-5-0-plugin-geoip-installed-errors-with-couldnt-find-any-filter-plugin-named-geoip/93033 "2017-07-13T14:29:50Z")
Hello! My knowledge of the inner workings of logstash are still limited, and now I've run into a problem I can't seem to solve. \[ERROR\]\[logstash.plugins.registry\] Problems loading a plugin with {:type=\>"filter", :nam… --- ## [Run logstash issue](https://discuss.elastic.co/t/run-logstash-issue/93003)
**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 2:25pm UTC](https://discuss.elastic.co/t/run-logstash-issue/93003 "2017-07-13T14:25:22Z")
I am trying to configure logstash with config file nammed simple.conf after edeting it i tried to run logstash with the following command so i get this error \[cmarwa@vds005 bin\]$ cd /home/cmarwa/logstash-5.5.0/bin \[cm… --- ## [JDBC password filepath issue](https://discuss.elastic.co/t/jdbc-password-filepath-issue/90620)
**Author:** [@sanuj5](https://discuss.elastic.co/u/sanuj5)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 2:23pm UTC](https://discuss.elastic.co/t/jdbc-password-filepath-issue/90620 "2017-07-13T14:23:27Z")
I am getting invalid username/password when I configure my JDBC connection to retrieve password from file. I have provided enough permission to the password file. It works well when I provide password in config itself. B… --- ## [Input json file into elasticsearch via logstash](https://discuss.elastic.co/t/input-json-file-into-elasticsearch-via-logstash/92766)
**Author:** [@bhavna\_jha](https://discuss.elastic.co/u/bhavna_jha)\ **Replies:** 5\ **Last updated:** [July 13, 2017, 2:17pm UTC](https://discuss.elastic.co/t/input-json-file-into-elasticsearch-via-logstash/92766 "2017-07-13T14:17:36Z")
HI, I am trying to input json file into elasticsearch but I get this error: Could not find log4j2 configuration at path /logstash-5.4.0/config/log4j2.properties. Using default config which logs to console 12:27:10.702 … --- ## [Unable to connect logstash with SQLSERVER](https://discuss.elastic.co/t/unable-to-connect-logstash-with-sqlserver/92642)
**Author:** [@Blue\_Moon](https://discuss.elastic.co/u/Blue_Moon)\ **Replies:** 1\ **Last updated:** [July 13, 2017, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-connect-logstash-with-sqlserver/92642 "2017-07-13T13:44:46Z")
i am using the below configuration. input{ jdbc { jdbc\_connection\_string =\> "jdbc:sqlserver:rpdidbtest.database.windows.net;databaseName=TEST\_DB;integratedSecurity=false;user=\*\*\*\*\*;password=\*\*\*\*\*\*;" jdbc\_user =\>… --- ## [Jdbc\_password\_filepath not functioning in input-jdbc filter](https://discuss.elastic.co/t/jdbc-password-filepath-not-functioning-in-input-jdbc-filter/92089)
**Author:** [@lnm](https://discuss.elastic.co/u/lnm)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 1:11pm UTC](https://discuss.elastic.co/t/jdbc-password-filepath-not-functioning-in-input-jdbc-filter/92089 "2017-07-13T13:11:33Z")
Hi everyone, I'm currently building some Logstash input filters which works great. The one thing I can't get working though is the jdbc\_password\_filepath setting. The query below is what I'm trying to run, with some… --- ## [Geo location long, lat values wrong](https://discuss.elastic.co/t/geo-location-long-lat-values-wrong/92959)
**Author:** [@Patrik\_Soderstrom](https://discuss.elastic.co/u/Patrik_Soderstrom)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 12:05pm UTC](https://discuss.elastic.co/t/geo-location-long-lat-values-wrong/92959 "2017-07-13T12:05:22Z")
Hi again, this time I have trouble with values for longitue and latitude. In Logstash I have this filter, mutate { add\_field =\> { "\[geo\]\[location\]" =\> "%{\[IN\]\[LocationLongitude\]}, %{\[IN\]\[LocationLatitude\]}" } }… --- ## [Logstash date parse failure for jdbc input](https://discuss.elastic.co/t/logstash-date-parse-failure-for-jdbc-input/92713)
**Author:** [@Bernie](https://discuss.elastic.co/u/Bernie)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-date-parse-failure-for-jdbc-input/92713 "2017-07-13T11:37:10Z")
Hi there, I currently encounter a strange problem while trying to get my Oracle-\>ES transfer working. Input is pretty much only jdbc and a "select event\_timestamp from table" where the column in the database is a "TI… --- ## [\_grokparsefailure tag added to log entries](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772)
**Author:** [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\ **Replies:** 3\ **Last updated:** [July 13, 2017, 11:09am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772 "2017-07-13T11:09:36Z")
I have following filer added to have a tag: "alert" added to logs coming from All Prod servers when the log-level is ERROR It does add the "alert" tag to logs from Prod servers when the loglevel is ERROR. However, whe… --- ## [Logstash is failing if one of the ES is down](https://discuss.elastic.co/t/logstash-is-failing-if-one-of-the-es-is-down/92639)
**Author:** [@Narayanan\_Sukumar](https://discuss.elastic.co/u/Narayanan_Sukumar)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 10:21am UTC](https://discuss.elastic.co/t/logstash-is-failing-if-one-of-the-es-is-down/92639 "2017-07-13T10:21:10Z")
I was doing some testing with my ELK setup before it is going into production. I have two ES clusters and based on the kafka topic it will push. I intentionally made the one of the ES down and the logstash is not pus… --- ## [Logstash stops with error: can't convert Array into String](https://discuss.elastic.co/t/logstash-stops-with-error-cant-convert-array-into-string/92974)
**Author:** [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\ **Replies:** 4\ **Last updated:** [July 13, 2017, 10:20am UTC](https://discuss.elastic.co/t/logstash-stops-with-error-cant-convert-array-into-string/92974 "2017-07-13T10:20:59Z")
Logstast stops in few minutes with following error: Sudo -u logstash /opt/logstash/bin/logstash -f /etc/logstash/conf.d/ slack plugin is using the 'milestone' method to declare the version of the plugin this metho… --- ## [Timeout executing grok 5.4.3](https://discuss.elastic.co/t/timeout-executing-grok-5-4-3/92222)
**Author:** [@steveng](https://discuss.elastic.co/u/steveng)\ **Replies:** 2\ **Last updated:** [July 13, 2017, 9:47am UTC](https://discuss.elastic.co/t/timeout-executing-grok-5-4-3/92222 "2017-07-13T09:47:58Z")
Hi, I send with Filebeat the file /usr/local/tomcat/current/logs/filieredistribution\_vodpublish.log in Logstash. I want to extract the filename without extension like this : grok { match =\> { "source" =\>… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=944) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=946)