# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=952 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 953 --- ## [How to construct geo\_point field from separate fields of latitude and longitude for Kibana 5.4?](https://discuss.elastic.co/t/how-to-construct-geo-point-field-from-separate-fields-of-latitude-and-longitude-for-kibana-5-4/91755)
**Author:** [@monai](https://discuss.elastic.co/u/monai)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 12:59am UTC](https://discuss.elastic.co/t/how-to-construct-geo-point-field-from-separate-fields-of-latitude-and-longitude-for-kibana-5-4/91755 "2017-07-05T00:59:40Z")
From input data I have 2 fields of location - latitude and longitude. How can I construct a geo\_point location field to create map visualization in logstash config (version 5.4)? Thank you. Updated - Summarize of the … --- ## [Removing parent fields and keeping nested fields of JSON](https://discuss.elastic.co/t/removing-parent-fields-and-keeping-nested-fields-of-json/90624)
**Author:** [@sachiiit](https://discuss.elastic.co/u/sachiiit)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 12:47am UTC](https://discuss.elastic.co/t/removing-parent-fields-and-keeping-nested-fields-of-json/90624 "2017-07-05T00:47:57Z")
I am getting the following event in my filter section { "@timestamp" =\> 2017-06-23T06:16:05.000Z, "@version" =\> "1", "event" =\> { "logLevel" =\> "INFO… --- ## [Filebeat and logstash connection](https://discuss.elastic.co/t/filebeat-and-logstash-connection/91791)
**Author:** [@erion](https://discuss.elastic.co/u/erion)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-connection/91791 "2017-07-04T15:03:41Z")
Hi, is possible connect filebeat to logstash with only filebeat.yml. whitout other config or json file such as filebeat.full.ymal filebeat.template.json filebeat.yml.save. In the end is possible mantain only filebeat.ym… --- ## [Oracle Audit Trail](https://discuss.elastic.co/t/oracle-audit-trail/89950)
**Author:** [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Replies:** 7\ **Last updated:** [July 4, 2017, 2:31pm UTC](https://discuss.elastic.co/t/oracle-audit-trail/89950 "2017-07-04T14:31:08Z")
Hello, I'm trying to get oracle audit trail using logstash, what options I have that could help me achieve that. I wanted to use audit trail to OS but the columns sql\_bind, sql\_text are not written so I only have two o… --- ## [userAgent Filter and Internet Explorer](https://discuss.elastic.co/t/useragent-filter-and-internet-explorer/91784)
**Author:** [@blanks](https://discuss.elastic.co/u/blanks)\ **Replies:** 0\ **Last updated:** [July 4, 2017, 1:55pm UTC](https://discuss.elastic.co/t/useragent-filter-and-internet-explorer/91784 "2017-07-04T13:55:23Z")
Hi there, today I was looking at my browser distribution and I thought its a bit strange that all IE Users are on IE 11. So I checked my logs and found out that the agent: userAgent: "Mozilla/5.0 (compatible; MSIE 10.… --- ## [Logstash Kafka Input Plugin consumer not reading messages of Kafka topic](https://discuss.elastic.co/t/logstash-kafka-input-plugin-consumer-not-reading-messages-of-kafka-topic/91686)
**Author:** [@sgunnala](https://discuss.elastic.co/u/sgunnala)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 1:33pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-consumer-not-reading-messages-of-kafka-topic/91686 "2017-07-04T13:33:17Z")
Kafka 0.9 filebeats 5.1 LogstashIndexer: 5.0.2 with Kafka Input plugin log process generated a 40 mil lag and consumer stopped consuming. Tried restarts and config changes but No luck. Not sure when it stopped proce… --- ## [Csv filter, how to ignore new line?](https://discuss.elastic.co/t/csv-filter-how-to-ignore-new-line/91721)
**Author:** [@gogo1525](https://discuss.elastic.co/u/gogo1525)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 12:58pm UTC](https://discuss.elastic.co/t/csv-filter-how-to-ignore-new-line/91721 "2017-07-04T12:58:02Z")
Below is source example. Below is only 1 log. a|b|c|ddd|basdsadsa asdsadsa asdsadsad asdsads| Condition: , 5 Fields(A,B,C,D,E) , 1 separators ( | ) , csv filter, In this case, How to ignore newlines in 5th fiel… --- ## [Sorting based on event\_time in logstash](https://discuss.elastic.co/t/sorting-based-on-event-time-in-logstash/91636)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 10\ **Last updated:** [July 4, 2017, 12:44pm UTC](https://discuss.elastic.co/t/sorting-based-on-event-time-in-logstash/91636 "2017-07-04T12:44:45Z")
Hi, Thanks for helping me in all the stuff. Now, I am facing a weird problem. These are my logs 2017-01-03 05:40:50.522 INFO main ---\> org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPo… --- ## [Logstash multiline fails to detect TIMESTAMP and puts the whole file into a single doc](https://discuss.elastic.co/t/logstash-multiline-fails-to-detect-timestamp-and-puts-the-whole-file-into-a-single-doc/91546)
**Author:** [@bizmate](https://discuss.elastic.co/u/bizmate)\ **Replies:** 3\ **Last updated:** [July 4, 2017, 12:00pm UTC](https://discuss.elastic.co/t/logstash-multiline-fails-to-detect-timestamp-and-puts-the-whole-file-into-a-single-doc/91546 "2017-07-04T12:00:28Z")
I am using a docker container to spin and push logs up (not a huge quantity) from my PHP app where sometimes lines are broken down into multiple lines by the framework. Example 2017/05/21 06:02:05 \[trace\] \[system.… --- ## [Filebeat is not receiving logs from logstash](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738)
**Author:** [@DharaniKumar](https://discuss.elastic.co/u/DharaniKumar)\ **Replies:** 12\ **Last updated:** [July 4, 2017, 11:33am UTC](https://discuss.elastic.co/t/filebeat-is-not-receiving-logs-from-logstash/91738 "2017-07-04T11:33:14Z")
\[2017-07-04T14:24:02,247\]\[ERROR\]\[logstash.outputs.elasticsearch\] Got a bad response code from server, but this code is not considered retryable. Request will be dropped {:code=\>401, :response\_body=\>"{\\"error\\":{\\"root\_ca… --- ## [Logstash + X-Pack with disabled security](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690)
**Author:** [@mario\_wood](https://discuss.elastic.co/u/mario_wood)\ **Replies:** 4\ **Last updated:** [July 4, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-x-pack-with-disabled-security/91690 "2017-07-04T09:36:45Z")
Hi, We're setting up an ELK cluster with X-Pack installed, initially with only monitoring enabled for X-Pack. We've got everything working correctly for elasticsearch and kibana, but logstash is failing to send metrics… --- ## [Logstash dublicate message](https://discuss.elastic.co/t/logstash-dublicate-message/91664)
**Author:** [@baha1](https://discuss.elastic.co/u/baha1)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 9:08am UTC](https://discuss.elastic.co/t/logstash-dublicate-message/91664 "2017-07-04T09:08:47Z")
Hi there, this is my pepiline.conf: input { file { path =\> "c:/logstash.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" codec =\> multiline { pattern =\> "^%… --- ## [Logstash WMI plugin help](https://discuss.elastic.co/t/logstash-wmi-plugin-help/55509)
**Author:** [@Jagadish\_Manepalli](https://discuss.elastic.co/u/Jagadish_Manepalli)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 8:24am UTC](https://discuss.elastic.co/t/logstash-wmi-plugin-help/55509 "2017-07-04T08:24:14Z")
Hi, I am trying to collect the performance counters on the windows system using the below configuration. But I am getting the following error. Please suggest me any solution to overcome the error. The error reported … --- ## [Issues with processing wrong input by logstash-filter-oui](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719)
**Author:** [@okazymyrov](https://discuss.elastic.co/u/okazymyrov)\ **Replies:** 2\ **Last updated:** [July 4, 2017, 8:22am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719 "2017-07-04T08:22:13Z")
Hello, I get an input from a 3rd-party program. The input data might be corrupted, for example: 1C:1D:86:41:3C:80 24:DE:C6:56:17-07-03 07:49:42 24:DE:C6:56:CB:C0 As a result, logstash crashes because of logstash-f… --- ## [Geoip is not generate .location](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 22\ **Last updated:** [July 4, 2017, 7:40am UTC](https://discuss.elastic.co/t/geoip-is-not-generate-location/90951 "2017-07-04T07:40:02Z")
Good morning, I'm working with ELK for Palo Alto and I wanna to make an update from normal charts to Map Chart. I've read different tutorials but it's not working properly Logstash filter if \[SourceAddress\] and \[Sour… --- ## [Logstash stops running after some time](https://discuss.elastic.co/t/logstash-stops-running-after-some-time/91634)
**Author:** [@Gopal](https://discuss.elastic.co/u/Gopal)\ **Replies:** 3\ **Last updated:** [July 4, 2017, 7:02am UTC](https://discuss.elastic.co/t/logstash-stops-running-after-some-time/91634 "2017-07-04T07:02:40Z")
Hi, I am facing issue with Logstash where it is being stopped suddenly when trying to send the output to SQS? Can any one help? Thanks in Advance! Regards, Gopal --- ## [Calculating before input plugin](https://discuss.elastic.co/t/calculating-before-input-plugin/91527)
**Author:** [@Newbie](https://discuss.elastic.co/u/Newbie)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 6:55am UTC](https://discuss.elastic.co/t/calculating-before-input-plugin/91527 "2017-07-04T06:55:29Z")
Hey, i need to calculate index for elasticsearch input based on the current date i've seen there is an option in elasticsearch to send an index as {now/d{dd/mm/yyyy}} but im aggregating data using elastic on the last 5 … --- ## [Multiline and grok filter to merge multi line and then filter](https://discuss.elastic.co/t/multiline-and-grok-filter-to-merge-multi-line-and-then-filter/91219)
**Author:** [@mharoonahmed](https://discuss.elastic.co/u/mharoonahmed)\ **Replies:** 6\ **Last updated:** [July 4, 2017, 5:40am UTC](https://discuss.elastic.co/t/multiline-and-grok-filter-to-merge-multi-line-and-then-filter/91219 "2017-07-04T05:40:18Z")
Hi experts I am very new to ELK stack and still learning. I have some logs streamed from a switch reporting congestion. Below is the log format. Record shows start, update and stop type records, with timestamp, interf… --- ## [Parse Json Array](https://discuss.elastic.co/t/parse-json-array/91704)
**Author:** [@Edufernandez2](https://discuss.elastic.co/u/Edufernandez2)\ **Replies:** 1\ **Last updated:** [July 4, 2017, 3:10am UTC](https://discuss.elastic.co/t/parse-json-array/91704 "2017-07-04T03:10:45Z")
Trying to parse a Json array like this message \[{"UserDomain":"VOFFICESECURE","UserName":"Administrator","ComputerName":"DC01.vofficesecure.com"},{"UserDomain":"VOFFICESECURE","UserName":"Administrator","ComputerName"… --- ## [\[Documentation Bug\]: jdbc input documentation shows wrong default value for last\_run\_metadata\_path](https://discuss.elastic.co/t/documentation-bug-jdbc-input-documentation-shows-wrong-default-value-for-last-run-metadata-path/91685)
**Author:** [@Tomaz\_Fogaca](https://discuss.elastic.co/u/Tomaz_Fogaca)\ **Replies:** 3\ **Last updated:** [July 3, 2017, 8:03pm UTC](https://discuss.elastic.co/t/documentation-bug-jdbc-input-documentation-shows-wrong-default-value-for-last-run-metadata-path/91685 "2017-07-03T20:03:28Z")
The jdbc documentation shows that the default value of last\_run\_metadata\_path is /Users/suyog/.logstash\_jdbc\_last\_run, which looks like the eval'ed value in the machine of the person who generated the documentation (on a… --- ## [Logstash-all-plugins Download](https://discuss.elastic.co/t/logstash-all-plugins-download/91637)
**Author:** [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Replies:** 1\ **Last updated:** [July 3, 2017, 6:09pm UTC](https://discuss.elastic.co/t/logstash-all-plugins-download/91637 "2017-07-03T18:09:29Z")
Hello, I'm downloading the latest version of logstash to install on a machine without internet connection. I want to use the xml plugin. Before I just downloaded the logstash-all-plugins pagacke/tar and used that, but I … --- ## [Run script from Logstash then fill new field with result](https://discuss.elastic.co/t/run-script-from-logstash-then-fill-new-field-with-result/91141)
**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Replies:** 9\ **Last updated:** [July 3, 2017, 6:04pm UTC](https://discuss.elastic.co/t/run-script-from-logstash-then-fill-new-field-with-result/91141 "2017-07-03T18:04:02Z")
Hello ! I'm completely new to the ELK stack, so sorry if my question looks quite stupid :slight\_smile: I'm trying to create a new field for Elasticsearch with Logstach by running a bash command. Explanations : … --- ## [Date filter and time zone transition](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672)
**Author:** [@simonhoenscheid](https://discuss.elastic.co/u/simonhoenscheid)\ **Replies:** 1\ **Last updated:** [July 3, 2017, 5:50pm UTC](https://discuss.elastic.co/t/date-filter-and-time-zone-transition/91672 "2017-07-03T17:50:57Z")
Hey there, I'm a bit confused how the date filter is working. I have a logstash config which is parsing cloudfront logs from an s3 input. which is working really nice. the timestamp in the logfile is UTC. So I adde… --- ## [Xml parse files help](https://discuss.elastic.co/t/xml-parse-files-help/87778)
**Author:** [@timj123](https://discuss.elastic.co/u/timj123)\ **Replies:** 6\ **Last updated:** [July 3, 2017, 5:40pm UTC](https://discuss.elastic.co/t/xml-parse-files-help/87778 "2017-07-03T17:40:36Z")
Everyone - I am really new to elk and I have a requirement to parse a very large (~1.9M line) xml file. In this xml file I want to capture two tag fields and create an timestamp field that all the events that follow wil… --- ## [Set "ssl" parameter for jdbc input plugin](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin/91676)
**Author:** [@Sergey\_Demidenko](https://discuss.elastic.co/u/Sergey_Demidenko)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 5:31pm UTC](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin/91676 "2017-07-03T17:31:27Z")
Hi. My Postgres connection requires setting two parameters: ssl=true sslmode=require I can't find any options to set these parameters. Is it possible to use jdbc input plugin in this case? --- ## [Packetbeat logs filter DNS array fields](https://discuss.elastic.co/t/packetbeat-logs-filter-dns-array-fields/51858)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 3:40pm UTC](https://discuss.elastic.co/t/packetbeat-logs-filter-dns-array-fields/51858 "2017-07-03T15:40:55Z")
Hi All, I have requests assistance in the Packetbeat forum initially however was referred to the logstash section for assistance. Here is the link for additional information if required on the prior discussion: What I… --- ## [Logstash glusterfs plugin](https://discuss.elastic.co/t/logstash-glusterfs-plugin/91540)
**Author:** [@l.savarese](https://discuss.elastic.co/u/l.savarese)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 2:57pm UTC](https://discuss.elastic.co/t/logstash-glusterfs-plugin/91540 "2017-07-03T14:57:29Z")
Hello everybody. In a new project, I need to archive the log files on glusterfs storage. I would need to use a glusterfs plugin similar to "logstash-output-webhdfs" but I did not find anything like that. Can someo… --- ## [Multiple logstash instances reading from multiple kafka inputs](https://discuss.elastic.co/t/multiple-logstash-instances-reading-from-multiple-kafka-inputs/91646)
**Author:** [@Tirthankar\_Sarkar](https://discuss.elastic.co/u/Tirthankar_Sarkar)\ **Replies:** 0\ **Last updated:** [July 3, 2017, 2:07pm UTC](https://discuss.elastic.co/t/multiple-logstash-instances-reading-from-multiple-kafka-inputs/91646 "2017-07-03T14:07:22Z")
Hi, My use case is - I have multiple kafka topics, each with one partition. Say I have n topics, all topics names are like foo-\*(can be defined by standard regex) - I want multiple logstash instances to consume from the… --- ## [Convert netsted array into fields using Logstash](https://discuss.elastic.co/t/convert-netsted-array-into-fields-using-logstash/91528)
**Author:** [@JukeBox](https://discuss.elastic.co/u/JukeBox)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 12:10pm UTC](https://discuss.elastic.co/t/convert-netsted-array-into-fields-using-logstash/91528 "2017-07-03T12:10:56Z")
Hi, I'm trying to convert an array with data keys and values into fields with the same name, but keep getting errors or problem with the Ruby filter plugin. I'll explain with example, I'm trying to take this json: { … --- ## [Syslog-ng + Logstash + Splunk](https://discuss.elastic.co/t/syslog-ng-logstash-splunk/91406)
**Author:** [@prash](https://discuss.elastic.co/u/prash)\ **Replies:** 8\ **Last updated:** [July 3, 2017, 11:18am UTC](https://discuss.elastic.co/t/syslog-ng-logstash-splunk/91406 "2017-07-03T11:18:12Z")
Hi , I am writing a Log collector for that I used "syslog-ng + Logstash + Splunk ". Along with these I want to use the Message broker or queue . Then my system will be "syslog-ng + Redis or RabitMQ+Logstash + Splunk. I… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=951) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=953)