# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=981 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 982 --- ## [Logstash spilt filter set defaut conf error](https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349)
**Author:** [@dean-river](https://discuss.elastic.co/u/dean-river)\ **Replies:** 0\ **Last updated:** [May 19, 2017, 3:05am UTC](https://discuss.elastic.co/t/logstash-spilt-filter-set-defaut-conf-error/86349 "2017-05-19T03:05:28Z")
I use one logstash multiline codec to merge multiline to one event ,and use spilt to spilt the multiline. the multiine logstash conf it like this: input{ file{ path =\> "/home/web\_server/report.log" sincedb\_path =\> … --- ## [Stop logstash](https://discuss.elastic.co/t/stop-logstash/86293)
**Author:** [@Hajer\_ben\_salem1](https://discuss.elastic.co/u/Hajer_ben_salem1)\ **Replies:** 1\ **Last updated:** [May 19, 2017, 2:24am UTC](https://discuss.elastic.co/t/stop-logstash/86293 "2017-05-19T02:24:19Z")
How can I stop the Logstash instance, while ensuring that it finish sending the bulks to Elasticsearch? I don't want to loose any logs while stopping logstash. My version od ELK is 5.3 My file.conf : input { http\_poll… --- ## [Logstash success output notification](https://discuss.elastic.co/t/logstash-success-output-notification/85697)
**Author:** [@shane\_lee](https://discuss.elastic.co/u/shane_lee)\ **Replies:** 15\ **Last updated:** [May 19, 2017, 1:49am UTC](https://discuss.elastic.co/t/logstash-success-output-notification/85697 "2017-05-19T01:49:04Z")
Hi all, I was wondering is it possible to send a message to SNS topic after successful bulk index to elasticsearch. Same for failure also. I have attached a high level solution design for reference. Thanks, Shane. … --- ## [If \[type\] is not working in logstash 2.3.2](https://discuss.elastic.co/t/if-type-is-not-working-in-logstash-2-3-2/54181)
**Author:** [@vasumathy](https://discuss.elastic.co/u/vasumathy)\ **Replies:** 5\ **Last updated:** [May 18, 2017, 9:17pm UTC](https://discuss.elastic.co/t/if-type-is-not-working-in-logstash-2-3-2/54181 "2017-05-18T21:17:26Z")
input { jdbc { type =\> "deploymaster" jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "" jdbc\_connection\_string =\> "" jdbc\_user =\> "" jdbc\_password =\> "" statement =\> "" } } output { if \[type\]… --- ## [Parsing http request in csv format](https://discuss.elastic.co/t/parsing-http-request-in-csv-format/86173)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 4\ **Last updated:** [May 18, 2017, 7:45pm UTC](https://discuss.elastic.co/t/parsing-http-request-in-csv-format/86173 "2017-05-18T19:45:13Z")
Hi, I have a project that requires me to download data from Yahoo flurry in csv format. Yahoo provides the API and I have the token. I can get the data using a REST client, but I am having a hard time with the logs… --- ## [How to configure FileBeat and Logstash to add XML Files in Elasticsearch?](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-to-add-xml-files-in-elasticsearch/86315)
**Author:** [@benjamin38600](https://discuss.elastic.co/u/benjamin38600)\ **Replies:** 0\ **Last updated:** [May 18, 2017, 5:51pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-and-logstash-to-add-xml-files-in-elasticsearch/86315 "2017-05-18T17:51:43Z")
Hi everybody, I'm a beginner here. My own problem is to configure FileBeat and Logstash to add XML Files in Elasticsearch on CentOS 7. I have already install the last version of filebeat, logstash, elasticsearch and Kib… --- ## [Grok parse failure but matched in grok constructor?](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 5:42pm UTC](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152 "2017-05-18T17:42:25Z")
Hi, My logs are like this: \[2017-05-17 22:22:55,708\]\[WARN \]\[index.indexing.slowlog.index\] \[Torpedo\]\[bank\]\[1\] took\[101.4ms\], took\_millis\[101\], type\[detail\], id\[88\], routing\[\] , source\[{"account\_number":25,"balance":40… --- ## [Grok parsing gives Unexpected outcome](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214)
**Author:** [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\ **Replies:** 7\ **Last updated:** [May 18, 2017, 12:01pm UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214 "2017-05-18T12:01:13Z")
The expected outcome is the following in each event: interface internet\_address physical\_address type grok only parses the first match, i dont really get whats going on here. here is the UNEXPECTED outcome: he… --- ## [Timezone that handles daylight saving change](https://discuss.elastic.co/t/timezone-that-handles-daylight-saving-change/85808)
**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\ **Replies:** 3\ **Last updated:** [May 18, 2017, 11:22am UTC](https://discuss.elastic.co/t/timezone-that-handles-daylight-saving-change/85808 "2017-05-18T11:22:22Z")
I have searched for an answer to this, but I'm still not clear. I have some logs that contain a timestamp, but no timezone. I understand that I can specify a timezone using filter.date.timezone in the Logstash pipeline… --- ## [Logstash plugin development problem](https://discuss.elastic.co/t/logstash-plugin-development-problem/86240)
**Author:** [@iheb](https://discuss.elastic.co/u/iheb)\ **Replies:** 0\ **Last updated:** [May 18, 2017, 10:45am UTC](https://discuss.elastic.co/t/logstash-plugin-development-problem/86240 "2017-05-18T10:45:46Z")
I'm trying to develop an input plugin for logstash. i've used this tutorial the problem that i've had when i tried to install "bundle" using "bundle install" - this is the error message Your Ruby engine is ru… --- ## [Logstash not request after some time- JSON](https://discuss.elastic.co/t/logstash-not-request-after-some-time-json/86215)
**Author:** [@shrwn](https://discuss.elastic.co/u/shrwn)\ **Replies:** 0\ **Last updated:** [May 18, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-not-request-after-some-time-json/86215 "2017-05-18T09:13:38Z")
Hi All, We are using logstash-1.5.3 we are getting JSON type as input and splitting it using ruby code. Logstash stop serving request for JSON array after some time(logstash process live). Please guide. --- ## [Can't parse number](https://discuss.elastic.co/t/cant-parse-number/86211)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 0\ **Last updated:** [May 18, 2017, 8:24am UTC](https://discuss.elastic.co/t/cant-parse-number/86211 "2017-05-18T08:24:32Z")
Failed action. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-access\_api-2017.05.17", :\_type=\>"access\_api", :\_routing=\>nil}, 2017-05-17T15:07:51.000Z %{host} %{message}\], :response=\>{"index"=\>{"\_index"… --- ## [Logstash 5.4.0 not sending logs](https://discuss.elastic.co/t/logstash-5-4-0-not-sending-logs/86093)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 4:38am UTC](https://discuss.elastic.co/t/logstash-5-4-0-not-sending-logs/86093 "2017-05-18T04:38:49Z")
I am using a fresh install of the ELK stack 5.4.0 Elasticsearch, Logstash, kibana with X-pack Now when i fire a configuration given below input { file{ path =\> "C:\\somepath\\path\\file.csv" start\_position =\> beginn… --- ## [Change time zone of output to ES index](https://discuss.elastic.co/t/change-time-zone-of-output-to-es-index/86048)
**Author:** [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\ **Replies:** 2\ **Last updated:** [May 18, 2017, 5:47am UTC](https://discuss.elastic.co/t/change-time-zone-of-output-to-es-index/86048 "2017-05-18T05:47:46Z")
Hi, I am outputting to Elasticsearch with date specific indices. My server time zone is in IST but problem I am facing is my Elasticsearch index changes as per UTC time zone. How can i change timezone or ES index creat… --- ## [HA and Distributed Logstash with multiline codec](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003)
**Author:** [@Willi\_Trace](https://discuss.elastic.co/u/Willi_Trace)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 5:32am UTC](https://discuss.elastic.co/t/ha-and-distributed-logstash-with-multiline-codec/86003 "2017-05-18T05:32:44Z")
I am using syslog input plugin with multiline code to ingest messages from routers and Java applications (multiline mainly for Java exceptions). I need to scale Logstash to be high available and distributed. I can buil… --- ## [Further split logstash output for a particular field](https://discuss.elastic.co/t/further-split-logstash-output-for-a-particular-field/85996)
**Author:** [@amit.karir](https://discuss.elastic.co/u/amit.karir)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 5:31am UTC](https://discuss.elastic.co/t/further-split-logstash-output-for-a-particular-field/85996 "2017-05-18T05:31:16Z")
Hi, I have got my sql server data(from a table) sent to logstash and here is the stdout looks like: { "exception" =\> "A exception with a null response was thrown sending an HTTP request to the remo… --- ## [Logstash write to influx and elastic](https://discuss.elastic.co/t/logstash-write-to-influx-and-elastic/85797)
**Author:** [@bob\_monty](https://discuss.elastic.co/u/bob_monty)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 5:24am UTC](https://discuss.elastic.co/t/logstash-write-to-influx-and-elastic/85797 "2017-05-18T05:24:08Z")
Greetings is it possible to write to 2 time series databases at the same time? For example influx and elasticsearch. Currently i'm writing only to influx: output { if \[@influx\_measurement\] =~ /(SYS\_.\*)/ { … --- ## [Oauth 2.0 support in Logstash http output plugin](https://discuss.elastic.co/t/oauth-2-0-support-in-logstash-http-output-plugin/86191)
**Author:** [@waqas\_ali\_razzaq](https://discuss.elastic.co/u/waqas_ali_razzaq)\ **Replies:** 0\ **Last updated:** [May 18, 2017, 4:16am UTC](https://discuss.elastic.co/t/oauth-2-0-support-in-logstash-http-output-plugin/86191 "2017-05-18T04:16:24Z")
I have a scenario where I want to publish the log events to the rest API using logstash http output plugin. My rest API has Oauth 2.0 authorization enabled. I have placed the access token in header section of http output… --- ## [Cannot create pipeline, expected one of #](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723)
**Author:** [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Replies:** 4\ **Last updated:** [May 18, 2017, 2:21am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-expected-one-of/85723 "2017-05-18T02:21:15Z")
Dear All, I am trying to follow instructions from this website: https://github.com/elastic/examples/tree/master/ElasticStack\_apache However, I have got this error when I run this command: logstash -f apache\_logstash.co… --- ## [Couchdb (cloudant) multi server, different SEQ value each \_changes request handling?](https://discuss.elastic.co/t/couchdb-cloudant-multi-server-different-seq-value-each--changes-request-handling/85142)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 1\ **Last updated:** [May 17, 2017, 11:31pm UTC](https://discuss.elastic.co/t/couchdb-cloudant-multi-server-different-seq-value-each--changes-request-handling/85142 "2017-05-17T23:31:17Z")
I have couchdb running on cloudant with multiple servers, the question is when i go to the \_changes endpoint i can see different seq values on each refresh because it's hitting a different server (for the same index). Ho… --- ## [Http\_poller help including headers](https://discuss.elastic.co/t/http-poller-help-including-headers/86158)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 6:02pm UTC](https://discuss.elastic.co/t/http-poller-help-including-headers/86158 "2017-05-17T18:02:38Z")
update... I figured out the header issue. I added a new line to the headers section like this. headers =\> { Accept =\> "application/json" "Authorization" =\> "Bearer \ **Author:** [@ariels](https://discuss.elastic.co/u/ariels)\ **Replies:** 0\ **Last updated:** [May 16, 2017, 12:51am UTC](https://discuss.elastic.co/t/adjust-resources-for-a-memory-heavy-logstash-filter/85842 "2017-05-16T00:51:28Z") Hi, I'm writing a custom filter that reads from a file and generates potentially huge amount of events (based on how many lines it contains), where each line is translated to a yielded event. With default settings, it … --- ## [Logstash cannot call SQL Stored Procedure](https://discuss.elastic.co/t/logstash-cannot-call-sql-stored-procedure/44271)
**Author:** [@vikram\_yerneni](https://discuss.elastic.co/u/vikram_yerneni)\ **Replies:** 13\ **Last updated:** [May 17, 2017, 4:26pm UTC](https://discuss.elastic.co/t/logstash-cannot-call-sql-stored-procedure/44271 "2017-05-17T16:26:49Z")
Hi ELK Folks, I have an issue with pulling the data by calling a SQL Stored Procedure. I am using logstash agent to push the data and we are trying to pull in SQL Data in the form of a Stored Procedure. Its keep on thro… --- ## [No reconnect after shutdown: running logstash rabbitmq input plugin in docker/kubernetes](https://discuss.elastic.co/t/no-reconnect-after-shutdown-running-logstash-rabbitmq-input-plugin-in-docker-kubernetes/86139)
**Author:** [@Kuckkuck](https://discuss.elastic.co/u/Kuckkuck)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 3:56pm UTC](https://discuss.elastic.co/t/no-reconnect-after-shutdown-running-logstash-rabbitmq-input-plugin-in-docker-kubernetes/86139 "2017-05-17T15:56:46Z")
Hi, I am using logstash 5.3.2. The offical docker image from elastic.io. Both rabbitmq und logstash are running in a Kubernetes cluster. There is no reconnect/retry to connect to a new rabbitmq instance, if rabbitmq … --- ## [Help \_dateparsefailure](https://discuss.elastic.co/t/help--dateparsefailure/85607)
**Author:** [@renaton5](https://discuss.elastic.co/u/renaton5)\ **Replies:** 4\ **Last updated:** [May 17, 2017, 3:29pm UTC](https://discuss.elastic.co/t/help--dateparsefailure/85607 "2017-05-17T15:29:47Z")
Hi, I have a CSV, and the field TIME have this format \[12/May/2017:00:00:00 -0300\]. \[12/May/2017:00:00:00 -0300\]|Belo Horizonte|MG \[12/May/2017:01:00:00 -0300\]|São Paulo|SP \[12/May/2017:02:00:00 -0300\]|Rio de Janeiro… --- ## [Logstash kv filter questions](https://discuss.elastic.co/t/logstash-kv-filter-questions/86133)
**Author:** [@Singard123](https://discuss.elastic.co/u/Singard123)\ **Replies:** 0\ **Last updated:** [May 17, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-questions/86133 "2017-05-17T15:11:39Z")
I am trying to parse the log but right now all the messages has been parsed into one field and it looks like this message:time=2017-05-17T11:01:05.810417-04:00 e\[32mseverity=INFO e\[0m pid=76561 method=GET path=/studies… --- ## [Initial startup (bulk api) does not use my template](https://discuss.elastic.co/t/initial-startup-bulk-api-does-not-use-my-template/51318)
**Author:** [@remco](https://discuss.elastic.co/u/remco)\ **Replies:** 7\ **Last updated:** [May 17, 2017, 3:03pm UTC](https://discuss.elastic.co/t/initial-startup-bulk-api-does-not-use-my-template/51318 "2017-05-17T15:03:17Z")
Hi, I have installed ELK (eleasticsearch 2.3.1 logstash 2.3.0 and kibana 4.5). when the system is started and ELK is started for the first time (via linux services). Logstash mappings are not created with my own templa… --- ## [Using event API for timestamp formatting](https://discuss.elastic.co/t/using-event-api-for-timestamp-formatting/85374)
**Author:** [@arnold79](https://discuss.elastic.co/u/arnold79)\ **Replies:** 3\ **Last updated:** [May 17, 2017, 2:53pm UTC](https://discuss.elastic.co/t/using-event-api-for-timestamp-formatting/85374 "2017-05-17T14:53:30Z")
Hi all, I need to escalate events towards a separate output. The events are received in UTC timezone and need to be converted to Europe/Amsterdam. I've created a date filter to add additional two hours and ruby filter … --- ## [Failed to create event](https://discuss.elastic.co/t/failed-to-create-event/86006)
**Author:** [@craftytech1](https://discuss.elastic.co/u/craftytech1)\ **Replies:** 1\ **Last updated:** [May 17, 2017, 2:10pm UTC](https://discuss.elastic.co/t/failed-to-create-event/86006 "2017-05-17T14:10:06Z")
using ELK stack 5.3. I'm getting the following error message: \[ERROR\]\[logstash.inputs.metrics \] Failed to create monitoring event {:message=\>"For path: events", :error=\>"LogStash::Instrument::MetricStore::MetricNotFoun… --- ## [The datetime zone id is not recognised for pattern 'yyyy-MM-dd HH:mm:ss'](https://discuss.elastic.co/t/the-datetime-zone-id-is-not-recognised-for-pattern-yyyy-mm-dd-hh-mm-ss/46846)
**Author:** [@yahoo](https://discuss.elastic.co/u/yahoo)\ **Replies:** 6\ **Last updated:** [May 17, 2017, 1:45pm UTC](https://discuss.elastic.co/t/the-datetime-zone-id-is-not-recognised-for-pattern-yyyy-mm-dd-hh-mm-ss/46846 "2017-05-17T13:45:57Z")
Hi I wanted to have one place for setting the time zone. This code is working: date { match =\> \["file\_time", "yyyy-MM-dd HH:mm:ss"\] target =\> "@timestamp" timezone =\> "America/New\_York" … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=980) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=982)