# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=949 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 950 --- ## [Logstash output zabbix](https://discuss.elastic.co/t/logstash-output-zabbix/92278)
**Author:** [@fredprod](https://discuss.elastic.co/u/fredprod)\ **Replies:** 3\ **Last updated:** [July 10, 2017, 1:47pm UTC](https://discuss.elastic.co/t/logstash-output-zabbix/92278 "2017-07-10T13:47:08Z")
I'm trying to use this to count http error code to begin using this plugin. But I got some error, so have you some good example ? I have this kind of errors in logstash logs: \[2017-07-06T15:30:48,394\]\[WARN \]\[logstash.out… --- ## [Fingerprint plugin stalled](https://discuss.elastic.co/t/fingerprint-plugin-stalled/92166)
**Author:** [@Jeff\_Bolle](https://discuss.elastic.co/u/Jeff_Bolle)\ **Replies:** 2\ **Last updated:** [July 10, 2017, 12:32pm UTC](https://discuss.elastic.co/t/fingerprint-plugin-stalled/92166 "2017-07-10T12:32:10Z")
In mid-June or so we started having something that feels like a performance issue, but with really low data volumes. We have gzipped logs being stored in an S3 bucket. From there, we use logstash with the S3 input plug… --- ## [Logstash-input-jms doesn't work with WebLogic Server 12.1.3.0.0](https://discuss.elastic.co/t/logstash-input-jms-doesnt-work-with-weblogic-server-12-1-3-0-0/92431)
**Author:** [@Cosmin\_Cosmin](https://discuss.elastic.co/u/Cosmin_Cosmin)\ **Replies:** 1\ **Last updated:** [July 10, 2017, 11:01am UTC](https://discuss.elastic.co/t/logstash-input-jms-doesnt-work-with-weblogic-server-12-1-3-0-0/92431 "2017-07-10T11:01:53Z")
Hi, I have logstash 5.5.0, I installed the logstash-input-jms plugin, was installed successfully. But when I try to run it it gives this error: \[2017-07-10T10:30:45,866\]\[WARN \]\[logstash.inputs.jms \] JMS Consumer d… --- ## [Updating documents with Elasticsearch output](https://discuss.elastic.co/t/updating-documents-with-elasticsearch-output/91898)
**Author:** [@orweinberger](https://discuss.elastic.co/u/orweinberger)\ **Replies:** 5\ **Last updated:** [July 10, 2017, 10:32am UTC](https://discuss.elastic.co/t/updating-documents-with-elasticsearch-output/91898 "2017-07-10T10:32:48Z")
I'm trying to figure out how to update documents properly using the Elasticsearch output. Documentation on this issue is very confusing. I have a document that might already be in Elasticsearch, and if so I would like … --- ## [Logstash -- \>kafka --\> logstash](https://discuss.elastic.co/t/logstash-kafka-logstash/92361)
**Author:** [@rsthakur83](https://discuss.elastic.co/u/rsthakur83)\ **Replies:** 4\ **Last updated:** [July 10, 2017, 7:45am UTC](https://discuss.elastic.co/t/logstash-kafka-logstash/92361 "2017-07-10T07:45:01Z")
Hi , Can someone suggest the step to achieve the below requirement. 1) Logstash collect the logs from apache, application server and pushing to kafka 2) kafka accepting the logs from logstash as input stream and for… --- ## [Docker Container Logstash not getting any logs](https://discuss.elastic.co/t/docker-container-logstash-not-getting-any-logs/92062)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 2\ **Last updated:** [July 10, 2017, 5:21am UTC](https://discuss.elastic.co/t/docker-container-logstash-not-getting-any-logs/92062 "2017-07-10T05:21:06Z")
Hallo, I have a weird problem regarding docker with logstash. I have a logstash configuration which is working. Logstash is also booting up properly. Sadly it doesnt output anything to stdout or to my GELF output. dock… --- ## [How to write a multi step logstash process](https://discuss.elastic.co/t/how-to-write-a-multi-step-logstash-process/92300)
**Author:** [@chetan\_vartak](https://discuss.elastic.co/u/chetan_vartak)\ **Replies:** 1\ **Last updated:** [July 10, 2017, 4:02am UTC](https://discuss.elastic.co/t/how-to-write-a-multi-step-logstash-process/92300 "2017-07-10T04:02:26Z")
I need to Read a csv file which contains (zipcode, latitude, longitude). Then for each zipcode find all documents in ES Then update the document with latitude and longitude (geo codes) Is something like this possible w… --- ## [Nested Json Array creation by Joining many Tables from Oracle](https://discuss.elastic.co/t/nested-json-array-creation-by-joining-many-tables-from-oracle/91865)
**Author:** [@karthickmr](https://discuss.elastic.co/u/karthickmr)\ **Replies:** 2\ **Last updated:** [July 10, 2017, 3:50am UTC](https://discuss.elastic.co/t/nested-json-array-creation-by-joining-many-tables-from-oracle/91865 "2017-07-10T03:50:34Z")
Hi All, I am new to ELK,As part of our POC I have installed ElasticSearch(5.4.2), Kibana and Logstash. We need to move data from oracle to Elasticsearch for analytics Purpose. Do we need to use any programming l… --- ## [Logstash throttling/caching](https://discuss.elastic.co/t/logstash-throttling-caching/92095)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 1\ **Last updated:** [July 9, 2017, 7:25pm UTC](https://discuss.elastic.co/t/logstash-throttling-caching/92095 "2017-07-09T19:25:44Z")
Hello, I'm using Logstash with a pipe input and an elasticsearch output. I know that my ES cluster has had availability problems recently. There were brief periods when the cluster was unavailable, and I want to ascerta… --- ## [Update action proccess log](https://discuss.elastic.co/t/update-action-proccess-log/92402)
**Author:** [@Eduard\_Kubanda](https://discuss.elastic.co/u/Eduard_Kubanda)\ **Replies:** 0\ **Last updated:** [July 9, 2017, 6:34pm UTC](https://discuss.elastic.co/t/update-action-proccess-log/92402 "2017-07-09T18:34:53Z")
Hi there, I checked Logstash reference for update action (https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-action). Let's consider scenario: I want to ru… --- ## [SID field Mapping with Windows Active Directory Users](https://discuss.elastic.co/t/sid-field-mapping-with-windows-active-directory-users/92037)
**Author:** [@saravanan.m](https://discuss.elastic.co/u/saravanan.m)\ **Replies:** 1\ **Last updated:** [July 9, 2017, 5:06pm UTC](https://discuss.elastic.co/t/sid-field-mapping-with-windows-active-directory-users/92037 "2017-07-09T17:06:17Z")
Hi I have created one POC setup in ELK for analyzing EMC ISILON storage audit log. I forwarded the log through Syslog server and filebeat is sending the log to logstash. The ISILON was integrated with Windows AD so i … --- ## [Logstash error from Beats JSON input](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028)
**Author:** [@Renz\_Rollon](https://discuss.elastic.co/u/Renz_Rollon)\ **Replies:** 1\ **Last updated:** [July 9, 2017, 5:05pm UTC](https://discuss.elastic.co/t/logstash-error-from-beats-json-input/92028 "2017-07-09T17:05:00Z")
Here's the log from beats' publish: { "@timestamp": "2017-07-06T07:12:12.629Z", "beat": { "hostname": "test", "name": "test", "version": "5.4.3" }, "input\_type": "log", … --- ## [Get logs from an remote SSH server without tools on remote server](https://discuss.elastic.co/t/get-logs-from-an-remote-ssh-server-without-tools-on-remote-server/92011)
**Author:** [@pcouas](https://discuss.elastic.co/u/pcouas)\ **Replies:** 1\ **Last updated:** [July 8, 2017, 3:54pm UTC](https://discuss.elastic.co/t/get-logs-from-an-remote-ssh-server-without-tools-on-remote-server/92011 "2017-07-08T15:54:20Z")
Hi, Currently i have an Windows Comptuter with Kibana 5 and two tomcat remote server. I could connect only with SSH vith putty to acces remote tomcat logs. I could not install tools on theses linux server Could i con… --- ## [Error when importing DATETIME field using sqlite plugin](https://discuss.elastic.co/t/error-when-importing-datetime-field-using-sqlite-plugin/90676)
**Author:** [@abham1](https://discuss.elastic.co/u/abham1)\ **Replies:** 3\ **Last updated:** [July 8, 2017, 12:54pm UTC](https://discuss.elastic.co/t/error-when-importing-datetime-field-using-sqlite-plugin/90676 "2017-07-08T12:54:27Z")
I'm unable to import an SQLite db containing a DATETIME field (eg. 2017-03-22 16:04:22) into Logstash using the SQLite plugin (it worked after I modified the db and changed this field to a string). My Configuration file … --- ## [Uknown error while parsing user agent data](https://discuss.elastic.co/t/uknown-error-while-parsing-user-agent-data/90743)
**Author:** [@karthikg](https://discuss.elastic.co/u/karthikg)\ **Replies:** 6\ **Last updated:** [July 8, 2017, 7:11am UTC](https://discuss.elastic.co/t/uknown-error-while-parsing-user-agent-data/90743 "2017-07-08T07:11:05Z")
I'm trying to parse some iis logs and i'm seeing this error in my logstash logs, which is leading me to lot of \_grokparsefailure error any idea how to mitigate this Logstash Logs \[2017-06-25T09:49:02,075\]\[ERROR\]\[logsta… --- ## [Email plugin-Connection refused](https://discuss.elastic.co/t/email-plugin-connection-refused/91821)
**Author:** [@Padmavathy](https://discuss.elastic.co/u/Padmavathy)\ **Replies:** 4\ **Last updated:** [July 8, 2017, 6:02am UTC](https://discuss.elastic.co/t/email-plugin-connection-refused/91821 "2017-07-08T06:02:01Z")
Can someone provide me docs related to email plugin. I get the error connection refused on using email plugin.How to proceed with this? --- ## [Logstash Certificate Error "Looks like you either have an invalid key..."](https://discuss.elastic.co/t/logstash-certificate-error-looks-like-you-either-have-an-invalid-key/92325)
**Author:** [@bfrd](https://discuss.elastic.co/u/bfrd)\ **Replies:** 3\ **Last updated:** [July 8, 2017, 2:02am UTC](https://discuss.elastic.co/t/logstash-certificate-error-looks-like-you-either-have-an-invalid-key/92325 "2017-07-08T02:02:41Z")
Hello there, I am installing the ELK stack on a new server, everything seems to be going well except for logstash. From the ELK server's /var/log/logstash/logstash-plain.log am getting: \[ERROR\]\[logstash.inputs.beats … --- ## [Http Output Plugin Compression Support](https://discuss.elastic.co/t/http-output-plugin-compression-support/92338)
**Author:** [@f9atanzh](https://discuss.elastic.co/u/f9atanzh)\ **Replies:** 0\ **Last updated:** [July 7, 2017, 11:51pm UTC](https://discuss.elastic.co/t/http-output-plugin-compression-support/92338 "2017-07-07T23:51:04Z")
Hello All, I wanted to put some more eyes on my suggestion for compression support in the Http output plugin. I'm specifically interested in supporting gzip compression. Here is the issue on github: The tldr; is t… --- ## [Failed to create monitoring event for help](https://discuss.elastic.co/t/failed-to-create-monitoring-event-for-help/92324)
**Author:** [@Ximeng\_Zhao](https://discuss.elastic.co/u/Ximeng_Zhao)\ **Replies:** 0\ **Last updated:** [July 7, 2017, 7:28pm UTC](https://discuss.elastic.co/t/failed-to-create-monitoring-event-for-help/92324 "2017-07-07T19:28:35Z")
Hi All, I tried to run logstash to send csv data to elasticsearch on localhost, but it gives the following errors, need help with this, thanks and please let me know if you need more information that I can make up here… --- ## [I want to use information from 2 files and insert to elasticsearh as a document](https://discuss.elastic.co/t/i-want-to-use-information-from-2-files-and-insert-to-elasticsearh-as-a-document/91813)
**Author:** [@g\_dev](https://discuss.elastic.co/u/g_dev)\ **Replies:** 2\ **Last updated:** [July 7, 2017, 6:41pm UTC](https://discuss.elastic.co/t/i-want-to-use-information-from-2-files-and-insert-to-elasticsearh-as-a-document/91813 "2017-07-07T18:41:26Z")
I have the situation where I want to parse from the log file and insert each log as a document in elasticsearch but same time I want to get log metadata from another file and insert to the documents created by log file i… --- ## [Smooth out logstash processing](https://discuss.elastic.co/t/smooth-out-logstash-processing/92294)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 0\ **Last updated:** [July 7, 2017, 3:15pm UTC](https://discuss.elastic.co/t/smooth-out-logstash-processing/92294 "2017-07-07T15:15:25Z")
I need some advice on how to smooth out the processing for input events in logstash. Here is how the server is currently processing events coming in: As you can see it can fluctuate from 25 to 356. There are about 3… --- ## [JDBC input pushed to the wrong ES output - configs are seemingly mixed up](https://discuss.elastic.co/t/jdbc-input-pushed-to-the-wrong-es-output-configs-are-seemingly-mixed-up/92132)
**Author:** [@Apolitosz](https://discuss.elastic.co/u/Apolitosz)\ **Replies:** 1\ **Last updated:** [July 7, 2017, 2:50pm UTC](https://discuss.elastic.co/t/jdbc-input-pushed-to-the-wrong-es-output-configs-are-seemingly-mixed-up/92132 "2017-07-07T14:50:52Z")
Hi everyone, I'm relative new to the ES/Logstash world, but I'll do my best to describe the problem I'm facing. We have ES running on a AWS instance (multiple ones I believe in a cluster, it wasn't me setting it up, … --- ## [Document id upsert update fields in new object and keep others](https://discuss.elastic.co/t/document-id-upsert-update-fields-in-new-object-and-keep-others/92285)
**Author:** [@Justin\_Cross](https://discuss.elastic.co/u/Justin_Cross)\ **Replies:** 0\ **Last updated:** [July 7, 2017, 2:32pm UTC](https://discuss.elastic.co/t/document-id-upsert-update-fields-in-new-object-and-keep-others/92285 "2017-07-07T14:32:10Z")
Hi, I am using Elasticsearch/logstash and have an issue when updating an existing index through logstash imagine the \_source object the first time is: "\_source": { "id": "1234", "msg\_rece… --- ## [Logstash output syslog plugin doesnt prefix output with \](https://discuss.elastic.co/t/logstash-output-syslog-plugin-doesnt-prefix-output-with-pri/91464)
**Author:** [@wayneB](https://discuss.elastic.co/u/wayneB)\ **Replies:** 5\ **Last updated:** [June 30, 2017, 7:40pm UTC](https://discuss.elastic.co/t/logstash-output-syslog-plugin-doesnt-prefix-output-with-pri/91464 "2017-06-30T19:40:50Z")
I'm a new user to logstash. I'm on a red hat linux system using logstash 5.4.0 and logstash-out-syslog 3.0.1 plugin. What must I do for the plugin to output a syslog with the RFC 3164 format that has the PRI prefix, s… --- ## [Keeping user installed plugins after logstash update](https://discuss.elastic.co/t/keeping-user-installed-plugins-after-logstash-update/92272)
**Author:** [@hydrapolic](https://discuss.elastic.co/u/hydrapolic)\ **Replies:** 0\ **Last updated:** [July 7, 2017, 1:00pm UTC](https://discuss.elastic.co/t/keeping-user-installed-plugins-after-logstash-update/92272 "2017-07-07T13:00:49Z")
After installing logstash 5.4.1: # emerge =app-admin/logstash-5.4.1 And setting up a config to include gelf as output: output { gelf { host =\> "graylog.example.com" } } Logstash fails to start because it ca… --- ## [Logstash Crash with Persistent Queue and Kafka Input](https://discuss.elastic.co/t/logstash-crash-with-persistent-queue-and-kafka-input/90479)
**Author:** [@Myles](https://discuss.elastic.co/u/Myles)\ **Replies:** 5\ **Last updated:** [July 7, 2017, 12:35pm UTC](https://discuss.elastic.co/t/logstash-crash-with-persistent-queue-and-kafka-input/90479 "2017-07-07T12:35:43Z")
I use to write all my beats output directly to my logstash nodes with persistent queue enabled with no issues. I have recently updated my elastic stack architecture to include a kafka cluster that all data goes to for lo… --- ## [Grok pattern with space](https://discuss.elastic.co/t/grok-pattern-with-space/92110)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 1\ **Last updated:** [July 7, 2017, 12:00pm UTC](https://discuss.elastic.co/t/grok-pattern-with-space/92110 "2017-07-07T12:00:55Z")
Hello, I did not find anything which solves my problem so I hope someone wil be able to help me. I want to grok this message: (I have no idea of the number of spaces in the message) 2017-07-06 14:15:03,311 | DEBUG | … --- ## [Failed to install template](https://discuss.elastic.co/t/failed-to-install-template/91918)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 2\ **Last updated:** [July 7, 2017, 10:06am UTC](https://discuss.elastic.co/t/failed-to-install-template/91918 "2017-07-07T10:06:57Z")
Hi, I use two different machine: one with filebeat and other with logstash. Elasticsearch is on web service. I configure filebeat.yml like this: filebeat.prospectors: -input\_type: log path: - /mnt/analisilog/www.a… --- ## [How to run logstash configuration file in windows 8 command prompt](https://discuss.elastic.co/t/how-to-run-logstash-configuration-file-in-windows-8-command-prompt/92202)
**Author:** [@saafianihan](https://discuss.elastic.co/u/saafianihan)\ **Replies:** 1\ **Last updated:** [July 7, 2017, 9:37am UTC](https://discuss.elastic.co/t/how-to-run-logstash-configuration-file-in-windows-8-command-prompt/92202 "2017-07-07T09:37:15Z")
I have to run configuration file which is inside of logstash directory. I followed the steps which provided in the document,but failed. while entering "logstash -f logstash.conf" in the command prompt, i am getting "lo… --- ## [How to write grok filter](https://discuss.elastic.co/t/how-to-write-grok-filter/92213)
**Author:** [@rp311286](https://discuss.elastic.co/u/rp311286)\ **Replies:** 1\ **Last updated:** [July 7, 2017, 9:35am UTC](https://discuss.elastic.co/t/how-to-write-grok-filter/92213 "2017-07-07T09:35:48Z")
here is my log file format ---Exception occure at 31-03-2017 11:19:25------- Error line no:233 ErrorMessage: DllNotFoundException ExceptionType: System.DllNotFoundException ControllerName: SocialmediaCountController A… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=948) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=950)