# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=951 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 952 --- ## [Dealing with default values and different outputs](https://discuss.elastic.co/t/dealing-with-default-values-and-different-outputs/91950)
**Author:** [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 6:01pm UTC](https://discuss.elastic.co/t/dealing-with-default-values-and-different-outputs/91950 "2017-07-05T18:01:30Z")
Various data-fields supplied by our CDN-providers sometimes contain dashes (a.k.a. hyphens) to indicate the particular piece of data being unavailable. We need to loop through all (well, most) of the fields and remove … --- ## [Set @timestamp value](https://discuss.elastic.co/t/set-timestamp-value/91958)
**Author:** [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 5:22pm UTC](https://discuss.elastic.co/t/set-timestamp-value/91958 "2017-07-05T17:22:26Z")
Hi , I have a situation , I need to send a lot of "old" logs to our ELK stack , I was doing some tests , and I realized that when logstash send the logs to elasticsearch it is seting the @timestamp field with the curren… --- ## [Logstash stops processing events](https://discuss.elastic.co/t/logstash-stops-processing-events/91956)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 4:09pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-events/91956 "2017-07-05T16:09:52Z")
i have 3 logstash 5.3.2 configured to fetch events from some kafka queues and receives also filebeat beat events. sometimes one or more logstash lock up, they stop processing events, send heartbeats events, nothing... bu… --- ## [Error in one output configuration stops processing events for all other outputs as well](https://discuss.elastic.co/t/error-in-one-output-configuration-stops-processing-events-for-all-other-outputs-as-well/88330)
**Author:** [@ronakg](https://discuss.elastic.co/u/ronakg)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 3:53pm UTC](https://discuss.elastic.co/t/error-in-one-output-configuration-stops-processing-events-for-all-other-outputs-as-well/88330 "2017-07-05T15:53:10Z")
Hi, I'm seeing that if one of the output configuration is getting into an error, other outputs are also affected. For example, I have one elasticsearch output and one syslog output. If the syslog output gets into an … --- ## [Puppet Logstash](https://discuss.elastic.co/t/puppet-logstash/88271)
**Author:** [@kxuan](https://discuss.elastic.co/u/kxuan)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 3:40pm UTC](https://discuss.elastic.co/t/puppet-logstash/88271 "2017-07-05T15:40:59Z")
Hi community, I want test the puppet-logstash module but i'm not sure that module is already fine to production because it dont pass travis-ci test phase. Any one using that ? Thanks, --- ## [Replication in ES](https://discuss.elastic.co/t/replication-in-es/89882)
**Author:** [@raghvendra](https://discuss.elastic.co/u/raghvendra)\ **Replies:** 7\ **Last updated:** [July 5, 2017, 2:31pm UTC](https://discuss.elastic.co/t/replication-in-es/89882 "2017-07-05T14:31:32Z")
Hey .. can anyone make one thing clear .. i was running ELK stack. Logstash was reading files from a logs from a folder on my local machine. I had to stop the logstash for some reason and then i had restarted it .. every… --- ## [Logstash status failed,why its not showing logstash is inactive when i stop logstatsh](https://discuss.elastic.co/t/logstash-status-failed-why-its-not-showing-logstash-is-inactive-when-i-stop-logstatsh/91747)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 2:20pm UTC](https://discuss.elastic.co/t/logstash-status-failed-why-its-not-showing-logstash-is-inactive-when-i-stop-logstatsh/91747 "2017-07-05T14:20:54Z")
root@dev01:~# service logstash stop root@dev01:~# service logstash status ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: Active: failed (Result: exit-cod… --- ## [Possible bug with geoip filter](https://discuss.elastic.co/t/possible-bug-with-geoip-filter/91921)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 2:18pm UTC](https://discuss.elastic.co/t/possible-bug-with-geoip-filter/91921 "2017-07-05T14:18:42Z")
I was looking at some of my logs this morning, and across all of my nodes, I am seeing an occasional log line that is consitent: \[2017-07-05T11:00:04,760\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[ES102\] \[log-source-20… --- ## [How to write my logstash config file](https://discuss.elastic.co/t/how-to-write-my-logstash-config-file/91915)
**Author:** [@stephen1](https://discuss.elastic.co/u/stephen1)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 1:45pm UTC](https://discuss.elastic.co/t/how-to-write-my-logstash-config-file/91915 "2017-07-05T13:45:25Z")
i'm new here and I need your help I don't know how to filter my log file correctly, that it appears correctly every data block is seperated with "------------------------------------------------------------" here's a… --- ## [Settings in Logstash output config file for "template =\>" not applied](https://discuss.elastic.co/t/settings-in-logstash-output-config-file-for-template-not-applied/89732)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 1:32pm UTC](https://discuss.elastic.co/t/settings-in-logstash-output-config-file-for-template-not-applied/89732 "2017-07-05T13:32:50Z")
Hi, I have struggled with this now for a bit over a week and I just can't seem to figure it out. I'm running 3 Elastic Stack setups for logging. In one setup I can't get "ignore\_malformed": "true" set for some reason. … --- ## [Another timestamp parsing question](https://discuss.elastic.co/t/another-timestamp-parsing-question/91908)
**Author:** [@Dee](https://discuss.elastic.co/u/Dee)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 1:11pm UTC](https://discuss.elastic.co/t/another-timestamp-parsing-question/91908 "2017-07-05T13:11:51Z")
Hi, I have this time format: 0705 16:06:23.522 This is my logstash configuration: json { source =\> "event" } date { match =\> \[ "time", "MMdd HH:mm:ss.SSS" \] remov… --- ## [Logstash-Kafka-output](https://discuss.elastic.co/t/logstash-kafka-output/91906)
**Author:** [@sat](https://discuss.elastic.co/u/sat)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 1:05pm UTC](https://discuss.elastic.co/t/logstash-kafka-output/91906 "2017-07-05T13:05:33Z")
I am using logstash (5.4.2) to process netflow on UDP port, which is collecting logs and bringing on logstash, writing to disk but not writing to kafka (0.9) topic. I tried producing messages to kafka and listed on consu… --- ## [Logstash binary as service is not running on CentOS 7 - SOLVED](https://discuss.elastic.co/t/logstash-binary-as-service-is-not-running-on-centos-7-solved/91620)
**Author:** [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\ **Replies:** 21\ **Last updated:** [July 5, 2017, 12:51pm UTC](https://discuss.elastic.co/t/logstash-binary-as-service-is-not-running-on-centos-7-solved/91620 "2017-07-05T12:51:30Z")
Dear All, I have installed latest logstash for CentOS 7 as per the official documents. When i run logstash sudo service logstash start It just doesn't work , no log files (even if i set the log level as debug in l… --- ## [Grok filter with spaces in field](https://discuss.elastic.co/t/grok-filter-with-spaces-in-field/91796)
**Author:** [@matt.wilcock](https://discuss.elastic.co/u/matt.wilcock)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 12:18pm UTC](https://discuss.elastic.co/t/grok-filter-with-spaces-in-field/91796 "2017-07-05T12:18:36Z")
Hi, I'm trying to work out how to build a grok filter with spaces in one of the fields but I'm not sure how to do it. The log looks like this: 2017-06-28 14:13:05 Coordinated Universal Time INFO \[1234:0x0000019f\] Loa… --- ## [\[logstash.pipeline\] Error registering plugin](https://discuss.elastic.co/t/logstash-pipeline-error-registering-plugin/91674)
**Author:** [@nir](https://discuss.elastic.co/u/nir)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 12:09pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-registering-plugin/91674 "2017-07-05T12:09:53Z")
Installed logstash 5.4.3 and elasticsearch 5.4.3 on Centos 7.3.1611 The configuration file in /etc/logstash/conf.d has the following lines input { tcp { port =\> 5000 type =\> syslog } udp { port =\> 5000 … --- ## [Can't get logstash-forwarder send data to logstash](https://discuss.elastic.co/t/cant-get-logstash-forwarder-send-data-to-logstash/91882)
**Author:** [@AllenShi](https://discuss.elastic.co/u/AllenShi)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 10:57am UTC](https://discuss.elastic.co/t/cant-get-logstash-forwarder-send-data-to-logstash/91882 "2017-07-05T10:57:07Z")
I'm using Logstash-forwarder to ship log to Logstash version 1:5.4.3-1 on Ubuntu 16.04. The configuration for lumberjack is: input { lumberjack { port =\> 5000 type =\> "logs" ssl\_certificate =\> "/etc/pki/tls… --- ## [ELK creates lots of hidden files](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748)
**Author:** [@nousees](https://discuss.elastic.co/u/nousees)\ **Replies:** 5\ **Last updated:** [July 5, 2017, 9:45am UTC](https://discuss.elastic.co/t/elk-creates-lots-of-hidden-files/91748 "2017-07-05T09:45:21Z")
Hello everybody, I've just installed logstash, elasticsearch and kibana. The issue is that I've found lots of hidden files with this format: .1015766.51411.253032 .200184.53366.432265 I've found it in several dire… --- ## [Messages grok parse failure](https://discuss.elastic.co/t/messages-grok-parse-failure/91806)
**Author:** [@mvelez83](https://discuss.elastic.co/u/mvelez83)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 9:33am UTC](https://discuss.elastic.co/t/messages-grok-parse-failure/91806 "2017-07-05T09:33:58Z")
Hello, I'm very new to creating Grok filters and I was going to create one for /var/log/messages (For named). Here is my logstash configuration I attempted to use: input { redis { host =\> "redis01.nyc.aevtech.net" … --- ## [Installing Plugin from local](https://discuss.elastic.co/t/installing-plugin-from-local/91868)
**Author:** [@Lukas\_Tilch](https://discuss.elastic.co/u/Lukas_Tilch)\ **Replies:** 0\ **Last updated:** [July 5, 2017, 9:18am UTC](https://discuss.elastic.co/t/installing-plugin-from-local/91868 "2017-07-05T09:18:54Z")
Hello, I tried installing the logstash-filter-prune plugin. since I can't seem to reach the ruby site from the corporate network through logstash, i wanted to install it manually. I downloaded the .gem and tried /logs… --- ## [Rufus-scheduler intercepted an error](https://discuss.elastic.co/t/rufus-scheduler-intercepted-an-error/91859)
**Author:** [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 9:16am UTC](https://discuss.elastic.co/t/rufus-scheduler-intercepted-an-error/91859 "2017-07-05T09:16:25Z")
I have this error message : { 1175704 rufus-scheduler intercepted an error: 1175704 job: 1175704 Rufus::Scheduler::CronJob "\*/5 \* \* \* \*" {} 1175704 error: … --- ## [How to logstash geoip database file update?](https://discuss.elastic.co/t/how-to-logstash-geoip-database-file-update/91359)
**Author:** [@TaeSung\_Kim](https://discuss.elastic.co/u/TaeSung_Kim)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 8:55am UTC](https://discuss.elastic.co/t/how-to-logstash-geoip-database-file-update/91359 "2017-07-05T08:55:11Z")
Hello, I'm TaeSung Kim. I'm sorry. I'm not used to English. Now, I use 5.2.2 ES, logstash, kibana. I find GeoLite2-City.mmdb file. /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-4.0.4-java/v… --- ## [Logstash with CSV filter not creating index when LS service is started as service](https://discuss.elastic.co/t/logstash-with-csv-filter-not-creating-index-when-ls-service-is-started-as-service/91851)
**Author:** [@kottapar](https://discuss.elastic.co/u/kottapar)\ **Replies:** 1\ **Last updated:** [July 5, 2017, 8:52am UTC](https://discuss.elastic.co/t/logstash-with-csv-filter-not-creating-index-when-ls-service-is-started-as-service/91851 "2017-07-05T08:52:57Z")
Hello, We're trying to index server details using the csv filter. The config file is as below. The weird problem we're facing is the index is created if I run logstash in foreground for testing. COMMAND /usr/share/l… --- ## [Logstash service don't work](https://discuss.elastic.co/t/logstash-service-dont-work/91645)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 7:23am UTC](https://discuss.elastic.co/t/logstash-service-dont-work/91645 "2017-07-05T07:23:26Z")
Hello, I have installed logstash as a service (rpm). But when I start the logstash service he doesn't send me anything to elasticsearch. I try to lauch logstash in /usr/share/logstash/bin and it works fine. What … --- ## [Issue with JMX Plugin - No such file or directory - No such directory](https://discuss.elastic.co/t/issue-with-jmx-plugin-no-such-file-or-directory-no-such-directory/90920)
**Author:** [@r4z0rw1r3666](https://discuss.elastic.co/u/r4z0rw1r3666)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 7:16am UTC](https://discuss.elastic.co/t/issue-with-jmx-plugin-no-such-file-or-directory-no-such-directory/90920 "2017-07-05T07:16:03Z")
Hello. I'm experiencing issues when attempting to get the JMX plugin to start via Logstash in a v5 ELK farm. I have previously installed the jmx plugin via bin/logstash-plugin install logstash-input-jmx and received an… --- ## [Index 404 error in logstash](https://discuss.elastic.co/t/index-404-error-in-logstash/91830)
**Author:** [@mkain](https://discuss.elastic.co/u/mkain)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 6:37am UTC](https://discuss.elastic.co/t/index-404-error-in-logstash/91830 "2017-07-05T06:37:16Z")
I have started getting following error in logstash. I had installed x-pack on on 3 ELK components and it was working fine for a while. but after few hours I started getting following error. I have even tried to remove … --- ## [Cron job](https://discuss.elastic.co/t/cron-job/91820)
**Author:** [@Padmavathy](https://discuss.elastic.co/u/Padmavathy)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 6:36am UTC](https://discuss.elastic.co/t/cron-job/91820 "2017-07-05T06:36:19Z")
Can someone provide me clarification on the below points 1.Is it possible to set a cron job so that it fetches records on a weekly basis(Example:every sunday) 2.While setting as a cron job the records are fetched from … --- ## [LS 5.4.3 w/ lumberjack input plugin - very slow processing of events](https://discuss.elastic.co/t/ls-5-4-3-w-lumberjack-input-plugin-very-slow-processing-of-events/91696)
**Author:** [@\_ale](https://discuss.elastic.co/u/_ale)\ **Replies:** 7\ **Last updated:** [July 5, 2017, 5:55am UTC](https://discuss.elastic.co/t/ls-5-4-3-w-lumberjack-input-plugin-very-slow-processing-of-events/91696 "2017-07-05T05:55:25Z")
Hi, we're upgrading to using the latest logstash with lumberjack input plugin, but it seems to be processing events extremely slow compared to the old LS version (1.5.x) - the setup is quite simple: logstash-shipp… --- ## [Drop Lines before multiline codec](https://discuss.elastic.co/t/drop-lines-before-multiline-codec/91500)
**Author:** [@ssstarquin](https://discuss.elastic.co/u/ssstarquin)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 5:07am UTC](https://discuss.elastic.co/t/drop-lines-before-multiline-codec/91500 "2017-07-05T05:07:24Z")
I am parsing multiple files using the multiline codec . Using the following to convert the file contents into one big string and then extract patterns i need from that string. input { file { path =\> "/… --- ## [Advice for mapping one to many relationships from ER DB](https://discuss.elastic.co/t/advice-for-mapping-one-to-many-relationships-from-er-db/90074)
**Author:** [@mulgar](https://discuss.elastic.co/u/mulgar)\ **Replies:** 3\ **Last updated:** [July 5, 2017, 4:58am UTC](https://discuss.elastic.co/t/advice-for-mapping-one-to-many-relationships-from-er-db/90074 "2017-07-05T04:58:01Z")
I'm looking for some advice on mapping a relatively simple dataset from an ER DB to ElasticSearch via LogStash. What I'm currently unsure about is how the mapping is done for zero to many relationships in the ER DB. Co… --- ## [Logstash can't connect to Elasticsearch when install X-Pack](https://discuss.elastic.co/t/logstash-cant-connect-to-elasticsearch-when-install-x-pack/91827)
**Author:** [@sonnguyenit](https://discuss.elastic.co/u/sonnguyenit)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 3:30am UTC](https://discuss.elastic.co/t/logstash-cant-connect-to-elasticsearch-when-install-x-pack/91827 "2017-07-05T03:30:16Z")
When i install x-pack plugin for ES, kibana, and logstash. Kibana work well. But Logstash can't connect to the ES. (ES install in a remote server). Before install x-pack, logstash work well. My logstash output configura… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=950) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=952)