# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=957 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 958 --- ## [What's the best way to feed aggregated stats into Graphite?](https://discuss.elastic.co/t/whats-the-best-way-to-feed-aggregated-stats-into-graphite/90551)
**Author:** [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\ **Replies:** 3\ **Last updated:** [June 27, 2017, 6:18am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-feed-aggregated-stats-into-graphite/90551 "2017-06-27T06:18:56Z")
When processing logs from a web-server for example, one is interested in average throughput and the browser-type breakdowns for one's site, whereas the individual hits aren't all that interesting. So, the graphite outp… --- ## [Logstash conf not working for json format](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109)
**Author:** [@gangamstyle](https://discuss.elastic.co/u/gangamstyle)\ **Replies:** 8\ **Last updated:** [June 27, 2017, 6:03am UTC](https://discuss.elastic.co/t/logstash-conf-not-working-for-json-format/90109 "2017-06-27T06:03:38Z")
Hi Marcus, I have tried the json plugin but it is not working plz help me {"\_id":{"$oid":"592fdb630b2262682c85351d"},"Date":"20170510","url":"Loading of Page /start","Device":"Mobile","Browser":"UC Browser mobile","B… --- ## [How to setup logstash cluster](https://discuss.elastic.co/t/how-to-setup-logstash-cluster/90403)
**Author:** [@Dheergudi](https://discuss.elastic.co/u/Dheergudi)\ **Replies:** 6\ **Last updated:** [June 27, 2017, 6:01am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-cluster/90403 "2017-06-27T06:01:57Z")
Hi there, I need help with setting up logstash cluster, I have one node for logstash I need to make It 2 or more node cluster. --- ## [How add processing time to the timestamp and create a new field for it](https://discuss.elastic.co/t/how-add-processing-time-to-the-timestamp-and-create-a-new-field-for-it/90666)
**Author:** [@Tejas\_Ghutukade](https://discuss.elastic.co/u/Tejas_Ghutukade)\ **Replies:** 1\ **Last updated:** [June 27, 2017, 5:50am UTC](https://discuss.elastic.co/t/how-add-processing-time-to-the-timestamp-and-create-a-new-field-for-it/90666 "2017-06-27T05:50:05Z")
Hi, I have field that stores a timestamp and a filed with processing time in milliseconds. I want to write a filter that adds the preocessing time to the timestamp and create another field the stores the completed ti… --- ## [Meaning of '+' in a grok? Recreating grok (secondary)](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878)
**Author:** [@CDR](https://discuss.elastic.co/u/CDR)\ **Replies:** 1\ **Last updated:** [June 27, 2017, 5:44am UTC](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878 "2017-06-27T05:44:53Z")
I inherited a configuration file that I need to build upon to make work for more logs. Currently when I run the stack I get errors 17:23:19.046 \[\[main\]\>worker11\] WARN logstash.filters.grok - Timeout executing grok '%{… --- ## [Logstash mssql config](https://discuss.elastic.co/t/logstash-mssql-config/90892)
**Author:** [@vanithapg](https://discuss.elastic.co/u/vanithapg)\ **Replies:** 1\ **Last updated:** [June 27, 2017, 5:41am UTC](https://discuss.elastic.co/t/logstash-mssql-config/90892 "2017-06-27T05:41:09Z")
This is the error im getting when i run this code C:\\elk\\logstash\\bin\>logstash -f ..\\conf\\mmsdb.conf Sending Logstash's logs to C:/elk/logstash/logs which is now configured via log4 j2.properties \[2017-06-26T19:21:42,… --- ## [Kafka-input plugin issue](https://discuss.elastic.co/t/kafka-input-plugin-issue/64086)
**Author:** [@rai](https://discuss.elastic.co/u/rai)\ **Replies:** 7\ **Last updated:** [June 27, 2017, 4:26am UTC](https://discuss.elastic.co/t/kafka-input-plugin-issue/64086 "2017-06-27T04:26:54Z")
I am trying to use kafka-input plugin with my elk image. I have created a docker iamge based on sebp/elk and add the following line in docker file to install kafka-input plugin. RUN gosu logstash bin/logstash-plugin… --- ## [How to remove unwanted tags from logstash](https://discuss.elastic.co/t/how-to-remove-unwanted-tags-from-logstash/90760)
**Author:** [@cazyfunlover](https://discuss.elastic.co/u/cazyfunlover)\ **Replies:** 3\ **Last updated:** [June 26, 2017, 9:30pm UTC](https://discuss.elastic.co/t/how-to-remove-unwanted-tags-from-logstash/90760 "2017-06-26T21:30:04Z")
Hi i wanted to remove duplicate tags like ("@version" ,"beat","hostname","name" ) , how can i do that ? { "msg" =\> "Beginning Product data refresh", "timestamp\_match" =\> "2017-06-25 12:1… --- ## [Logstash to logstash](https://discuss.elastic.co/t/logstash-to-logstash/90268)
**Author:** [@seighalani](https://discuss.elastic.co/u/seighalani)\ **Replies:** 4\ **Last updated:** [June 26, 2017, 9:23pm UTC](https://discuss.elastic.co/t/logstash-to-logstash/90268 "2017-06-26T21:23:49Z")
Hi everyone we have a big network with a lot of subnets. i want to send logs from each subnets to a logstash server in that subnet then that logstash server send to central logstash server in another subnet. is there… --- ## [Grok Patterns for Application logs](https://discuss.elastic.co/t/grok-patterns-for-application-logs/90386)
**Author:** [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\ **Replies:** 15\ **Last updated:** [June 26, 2017, 9:17pm UTC](https://discuss.elastic.co/t/grok-patterns-for-application-logs/90386 "2017-06-26T21:17:14Z")
I am newbie to ELK and need to integrate my logs as below to elasticsearch from logstash. Can some help me by providing log patterrns for below log format Filelog 2017-06-05 00:03:03 INFO HeartBeatDetailsTimerTask:… --- ## [Checking Field Length](https://discuss.elastic.co/t/checking-field-length/51335)
**Author:** [@wmikew5672](https://discuss.elastic.co/u/wmikew5672)\ **Replies:** 7\ **Last updated:** [June 26, 2017, 9:15pm UTC](https://discuss.elastic.co/t/checking-field-length/51335 "2017-06-26T21:15:34Z")
I'm still relatively new to Logstash, and I'm looking to find a way to check the length of an error message within a filter. If the message exceeds a defined number of characters, I want to output to an alternate ES inde… --- ## [Matching multiple logs to differnt patterns](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495)
**Author:** [@cisaksen](https://discuss.elastic.co/u/cisaksen)\ **Replies:** 3\ **Last updated:** [June 26, 2017, 9:06pm UTC](https://discuss.elastic.co/t/matching-multiple-logs-to-differnt-patterns/90495 "2017-06-26T21:06:54Z")
I'm using filebeat to send log files from different servers to logstash. Srv1 has an index of nginx, while srv2 has it set to apache. I have 2 patterns SED\_NGINX\_COMBINE(custom) and HTTPD\_COMBINELOG (builtin). Not sur… --- ## [Is restart required upon updating GeoIP database?](https://discuss.elastic.co/t/is-restart-required-upon-updating-geoip-database/90871)
**Author:** [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\ **Replies:** 0\ **Last updated:** [June 26, 2017, 8:25pm UTC](https://discuss.elastic.co/t/is-restart-required-upon-updating-geoip-database/90871 "2017-06-26T20:25:04Z")
Does Logstash need to be restarted for the updates to GeoIP data to take effect, or will the plugin notice the changes and automatically reopen the file(s)? A restart of Logstash here takes a few seconds -- we are worr… --- ## [Pipe Plugin Not Working on Windows](https://discuss.elastic.co/t/pipe-plugin-not-working-on-windows/89975)
**Author:** [@lynchnf](https://discuss.elastic.co/u/lynchnf)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 6:20pm UTC](https://discuss.elastic.co/t/pipe-plugin-not-working-on-windows/89975 "2017-06-26T18:20:24Z")
I'm trying to execute the Logstash-output-pipe plugin, but I can't get it to work with even simplest configuration. I'm executing this command: bin\\logstash.bat --path.settings /I:/logstash-5.2.2/config -l logs -f pipe… --- ## [What is the best way to log via tcp?](https://discuss.elastic.co/t/what-is-the-best-way-to-log-via-tcp/90658)
**Author:** [@Pommes9485](https://discuss.elastic.co/u/Pommes9485)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 6:18pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-log-via-tcp/90658 "2017-06-26T18:18:41Z")
Hey there, I've been playing with the elastic stack for the past month and would like to implement it into my application. The application is written in .NET and up until now I thought, that the communication via tcp … --- ## [Aggregate filter that stores the value from previous record](https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859)
**Author:** [@Tejas\_Ghutukade](https://discuss.elastic.co/u/Tejas_Ghutukade)\ **Replies:** 0\ **Last updated:** [June 26, 2017, 5:07pm UTC](https://discuss.elastic.co/t/aggregate-filter-that-stores-the-value-from-previous-record/90859 "2017-06-26T17:07:21Z")
I am trying to write aggregate filter in logstash which stores the value of previous record into a field. Here's my aggregate filter: aggregate { task\_id =\> "%{TRANSACTIONIDGLOBAL}" code =\> " map\['tr\_sta… --- ## [Logstash filter section problem](https://discuss.elastic.co/t/logstash-filter-section-problem/90826)
**Author:** [@jmbrown](https://discuss.elastic.co/u/jmbrown)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 4:29pm UTC](https://discuss.elastic.co/t/logstash-filter-section-problem/90826 "2017-06-26T16:29:13Z")
Hi, I'm trying to create a set of filters that will add a field based on a numeric value received by logstash. At the moment I'm just adding a TAG to see if the "IF" works. It appears that there is something wrong with m… --- ## [Packetbeat + kafka + Logstash - Mapping not working](https://discuss.elastic.co/t/packetbeat-kafka-logstash-mapping-not-working/90623)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 1\ **Last updated:** [June 26, 2017, 4:28pm UTC](https://discuss.elastic.co/t/packetbeat-kafka-logstash-mapping-not-working/90623 "2017-06-26T16:28:46Z")
I tried to introduce kafka into my existing infrastructure. But Mapping not working when I insert the packetbeat data on Kafka and read the data from kafka using Logstash. Even I updated the template (packetbeat.templa… --- ## [Calculating time between specific logs based on condition](https://discuss.elastic.co/t/calculating-time-between-specific-logs-based-on-condition/90852)
**Author:** [@perugoal2](https://discuss.elastic.co/u/perugoal2)\ **Replies:** 0\ **Last updated:** [June 26, 2017, 4:25pm UTC](https://discuss.elastic.co/t/calculating-time-between-specific-logs-based-on-condition/90852 "2017-06-26T16:25:30Z")
I have a lists of system logs in a log file ,in which I have to calculate time difference between two particular logs based on some condition @timestamp message May 19th 2016, 02:55:29.003 j… --- ## [Logstash monitoring issue when monitoring multiple nodes](https://discuss.elastic.co/t/logstash-monitoring-issue-when-monitoring-multiple-nodes/88860)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 5\ **Last updated:** [June 26, 2017, 4:08pm UTC](https://discuss.elastic.co/t/logstash-monitoring-issue-when-monitoring-multiple-nodes/88860 "2017-06-26T16:08:05Z")
Hi, I have recently built couple of new LS nodes and in our production to be cluster and installed x-pack on each one for monitoring. unfortunately im seeing a weird error and I hope someone has came across such issu… --- ## [Combining logs based on timestamp](https://discuss.elastic.co/t/combining-logs-based-on-timestamp/90849)
**Author:** [@infamous](https://discuss.elastic.co/u/infamous)\ **Replies:** 0\ **Last updated:** [June 26, 2017, 4:04pm UTC](https://discuss.elastic.co/t/combining-logs-based-on-timestamp/90849 "2017-06-26T16:04:54Z")
Hi all, Im looking at ways to combine 2 distinct event logs only if their respective timestamps are the same. The 2 logs will be from different sources (2 different files). I am hoping to do this aggregation at time of… --- ## [44ddb9 logstash](https://discuss.elastic.co/t/44ddb9-logstash/90832)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [June 26, 2017, 2:40pm UTC](https://discuss.elastic.co/t/44ddb9-logstash/90832 "2017-06-26T14:40:21Z")
Hello, is there a logstash deployed with my cluster? if not, can you provide me a logstash.conf with the correct output tu push data into it (where to put the credentials?) --- ## [Getting error when using 'aggregate' in logstash 5.4](https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831)
**Author:** [@Ankit\_Gupta](https://discuss.elastic.co/u/Ankit_Gupta)\ **Replies:** 0\ **Last updated:** [June 26, 2017, 2:33pm UTC](https://discuss.elastic.co/t/getting-error-when-using-aggregate-in-logstash-5-4/90831 "2017-06-26T14:33:40Z")
Hello Everyone, I am new to logstash and using it to process Netflow data. I am trying to aggregate few events but I am getting error with 'task\_id' and couldn't figure out what wrong I am doing. I am pasting my filter… --- ## [Getting geoip to work in ELK 5](https://discuss.elastic.co/t/getting-geoip-to-work-in-elk-5/90641)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 1\ **Last updated:** [June 26, 2017, 1:06pm UTC](https://discuss.elastic.co/t/getting-geoip-to-work-in-elk-5/90641 "2017-06-26T13:06:53Z")
Hello, all. I hope I'm in the right forum for my problem. I've recently gotten the ELK 5.x stack set up and working. With the exception of geoip, that is. I've posted my config files here: https://pastebin.com/i0v5… --- ## [Upsert with logstash](https://discuss.elastic.co/t/upsert-with-logstash/59116)
**Author:** [@vtangutoori](https://discuss.elastic.co/u/vtangutoori)\ **Replies:** 6\ **Last updated:** [June 26, 2017, 12:58pm UTC](https://discuss.elastic.co/t/upsert-with-logstash/59116 "2017-06-26T12:58:53Z")
Hi, I am looking to upsert a value to a field in existing document in an array, i have the below config file but the system is throwing error with message shown after config file, can anyone please help. File: input { … --- ## [Logstash with X-Pack](https://discuss.elastic.co/t/logstash-with-x-pack/90230)
**Author:** [@tuanpembual](https://discuss.elastic.co/u/tuanpembual)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 12:36pm UTC](https://discuss.elastic.co/t/logstash-with-x-pack/90230 "2017-06-26T12:36:24Z")
Dear All, I have elk stack with difference machine \[Client - beat\] - \[VM1 - Logstash | 192.168.33.101\] - \[VM2 - ES and Kibana | 192.168.33.102\] I have install x-pack plugin for logstash, es, and kibana. and have succ… --- ## [Logstash service is stopping with more than one configurations](https://discuss.elastic.co/t/logstash-service-is-stopping-with-more-than-one-configurations/90758)
**Author:** [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Replies:** 1\ **Last updated:** [June 26, 2017, 12:18pm UTC](https://discuss.elastic.co/t/logstash-service-is-stopping-with-more-than-one-configurations/90758 "2017-06-26T12:18:06Z")
Hi, I am running Logstash service with 5 different configurations in /etc/logstash/conf.d. it stopping logstash service suddenly. Is it possible to run logstash service with more configs, if yes can you provide way… --- ## [Grok Filter not Matching multiple filters](https://discuss.elastic.co/t/grok-filter-not-matching-multiple-filters/90721)
**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 11:35am UTC](https://discuss.elastic.co/t/grok-filter-not-matching-multiple-filters/90721 "2017-06-26T11:35:54Z")
Dear Team I have following grok filter which matches 2 different fields from CSV file . However I have noticed that Logstash ignores the second line ( excuses) when sending the traffic to Elasticsearch . In case where… --- ## [Fields and values](https://discuss.elastic.co/t/fields-and-values/90644)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 2\ **Last updated:** [June 26, 2017, 10:21am UTC](https://discuss.elastic.co/t/fields-and-values/90644 "2017-06-26T10:21:33Z")
Hi All, Could anyone help me to remove " this double quote in the field and value.What has to be done ? FIELD is equal to DELSA="NR and value is 1235648978" so I want it as Field as DELSA=NR and value as 12356489… --- ## [Filter the data sent by filebeat](https://discuss.elastic.co/t/filter-the-data-sent-by-filebeat/90288)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 4\ **Last updated:** [June 26, 2017, 8:57am UTC](https://discuss.elastic.co/t/filter-the-data-sent-by-filebeat/90288 "2017-06-26T08:57:53Z")
Hello Everyone, I have a small problem with filebeat and logstash. On my logstash machine I receive data from two different servers (filebeat). The problem is that I don't want to apply the same filters to the 2 serv… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=956) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=958)