# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=986 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 987 --- ## [Problem with the date-filter (timezone)](https://discuss.elastic.co/t/problem-with-the-date-filter-timezone/85145)
**Author:** [@prime](https://discuss.elastic.co/u/prime)\ **Replies:** 16\ **Last updated:** [May 10, 2017, 2:05pm UTC](https://discuss.elastic.co/t/problem-with-the-date-filter-timezone/85145 "2017-05-10T14:05:52Z")
Hi, i'm new to elk, so it may be a layer 8 problem, but i'm not able to fix it. So i hope here's somebody able to help me. So currently the date-filter in my logstash config is not doing what i expect. I import csv File… --- ## [How to disable mib translation](https://discuss.elastic.co/t/how-to-disable-mib-translation/85258)
**Author:** [@rpoveda](https://discuss.elastic.co/u/rpoveda)\ **Replies:** 0\ **Last updated:** [May 10, 2017, 2:09pm UTC](https://discuss.elastic.co/t/how-to-disable-mib-translation/85258 "2017-05-10T14:09:24Z")
hi! i need forward snmp traps, and i dont want do a mib translation. can i do it? in this post i tried explain better that i want do: --- ## [Dome issues after update to 5.4](https://discuss.elastic.co/t/dome-issues-after-update-to-5-4/85062)
**Author:** [@orhiee](https://discuss.elastic.co/u/orhiee)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 1:48pm UTC](https://discuss.elastic.co/t/dome-issues-after-update-to-5-4/85062 "2017-05-10T13:48:42Z")
Hello, just updated to 5.4 and wanted to share a problem i had with the solution :slight\_smile: so i already had 5.x installed after upgrade i also installed x-pack (for the first time) and started to get the below i… --- ## [Logstash jdbc scheduler](https://discuss.elastic.co/t/logstash-jdbc-scheduler/85235)
**Author:** [@Djelouah\_Laala](https://discuss.elastic.co/u/Djelouah_Laala)\ **Replies:** 1\ **Last updated:** [May 10, 2017, 1:44pm UTC](https://discuss.elastic.co/t/logstash-jdbc-scheduler/85235 "2017-05-10T13:44:16Z")
Hi guys, I want to execute a query in jdbc twice a day, at 12:00 and at 14:00. I have this value in my scheduler schedule =\> "00 14 \* \* \*" which execute the query once a day at 14:00. How can I add 12:00? Thank … --- ## [Is it possible to log Azure Cloud Service Performance Counters in Elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-log-azure-cloud-service-performance-counters-in-elasticsearch/85126)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 3:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-log-azure-cloud-service-performance-counters-in-elasticsearch/85126 "2017-05-09T15:46:51Z")
Hi, My company would like to use Kibana to create views that display log and metric information output by our Azure Cloud Service Web Roles and Worker Roles. In particular, we'd like to store performance counter infor… --- ## [Logstash service exits when it gets log](https://discuss.elastic.co/t/logstash-service-exits-when-it-gets-log/85224)
**Author:** [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 1:04pm UTC](https://discuss.elastic.co/t/logstash-service-exits-when-it-gets-log/85224 "2017-05-10T13:04:06Z")
I use ELK stack to monitor logs from pfSense but I have a problem. As soon as I enable the remote logs on pfSense, Logstash stops, the service status is : active (exited). The last logs from logstash.log : {:timestam… --- ## [Logstash S3 output - NotImplementedError fstat error at startup](https://discuss.elastic.co/t/logstash-s3-output-notimplementederror-fstat-error-at-startup/83167)
**Author:** [@Domenico\_Riccio](https://discuss.elastic.co/u/Domenico_Riccio)\ **Replies:** 3\ **Last updated:** [May 10, 2017, 12:52pm UTC](https://discuss.elastic.co/t/logstash-s3-output-notimplementederror-fstat-error-at-startup/83167 "2017-05-10T12:52:36Z")
Hello, I'm getting this error when trying to start Logstash with S3 output, could you please help me? NotImplementedError: fstat unimplemented unsupported or native support failed to load size at org/jr… --- ## [Logstash : Obtain metrics from log file based on alert/error message](https://discuss.elastic.co/t/logstash-obtain-metrics-from-log-file-based-on-alert-error-message/85239)
**Author:** [@Kavin\_MJR](https://discuss.elastic.co/u/Kavin_MJR)\ **Replies:** 0\ **Last updated:** [May 10, 2017, 12:01pm UTC](https://discuss.elastic.co/t/logstash-obtain-metrics-from-log-file-based-on-alert-error-message/85239 "2017-05-10T12:01:30Z")
We are trying to read a input log file. Assume that the log file is from an application and it might have a combination both alerts and errors. We are trying to separate the alert and error messages and compute metrics o… --- ## [Use index and get value from an array in ruby logstash](https://discuss.elastic.co/t/use-index-and-get-value-from-an-array-in-ruby-logstash/85233)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 1\ **Last updated:** [May 10, 2017, 11:57am UTC](https://discuss.elastic.co/t/use-index-and-get-value-from-an-array-in-ruby-logstash/85233 "2017-05-10T11:57:45Z")
I have 2 input fields "id" =\> \[ \[0\] "0", \[1\] "3", \[2\] "5", \[3\] "7", \[4\] "9" \], "data" =\> \[ \[0\] "01", \[1\] "03", \[2\] "05", \[3\] "07", \[4\] "09" \], My requirement is that I want to get the index of "id" field where value … --- ## [How to configure log4j in ELK statck](https://discuss.elastic.co/t/how-to-configure-log4j-in-elk-statck/85236)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 1\ **Last updated:** [May 10, 2017, 11:57am UTC](https://discuss.elastic.co/t/how-to-configure-log4j-in-elk-statck/85236 "2017-05-10T11:57:01Z")
I have installed logstash log4j filter plugin.When i check logstash Configtest ,i have the following Warning log4j:WARN No appenders could be found for logger (org.apache.http.impl.conn.PoolingHttpClientConnectionManag… --- ## [Can we configure logstash output to send snmp trap?](https://discuss.elastic.co/t/can-we-configure-logstash-output-to-send-snmp-trap/1632)
**Author:** [@Dnyaneshwar\_Sonawane](https://discuss.elastic.co/u/Dnyaneshwar_Sonawane)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 11:35am UTC](https://discuss.elastic.co/t/can-we-configure-logstash-output-to-send-snmp-trap/1632 "2017-05-10T11:35:59Z")
can we configure logstash output to send snmp trap ? --- ## [IP2Location LITE and Logstash](https://discuss.elastic.co/t/ip2location-lite-and-logstash/83948)
**Author:** [@MikeC0](https://discuss.elastic.co/u/MikeC0)\ **Replies:** 5\ **Last updated:** [May 10, 2017, 11:23am UTC](https://discuss.elastic.co/t/ip2location-lite-and-logstash/83948 "2017-05-10T11:23:46Z")
It looks like Logstash is supporting GeoIP. However, we would like to use the free IP2Location LITE database in Logstash. Is there any 3rd party plug-in available? --- ## [Split array fields in logstash](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 21\ **Last updated:** [May 10, 2017, 10:03am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546 "2017-05-10T10:03:11Z")
I have an input where field and value is "id"=\["0", "7", "11", "39", "70"\] I want to split it and make index as key and split value as value. and then print the index where value is 39. ruby { code =\> " … --- ## [Logstash 5.4.0 Proxy Authentication Error](https://discuss.elastic.co/t/logstash-5-4-0-proxy-authentication-error/84737)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [May 5, 2017, 2:09pm UTC](https://discuss.elastic.co/t/logstash-5-4-0-proxy-authentication-error/84737 "2017-05-05T14:09:55Z")
Hi, I just installed Logstash 5.4.0 and I tried to install logstash-filter-translate-3.0.1.gem. However, I received an error: bin/logstash-plugin install --local logstash-filter-translate-3.0.1.gem ERROR: Something… --- ## [SNMP collection setup](https://discuss.elastic.co/t/snmp-collection-setup/85036)
**Author:** [@script007](https://discuss.elastic.co/u/script007)\ **Replies:** 2\ **Last updated:** [May 10, 2017, 7:50am UTC](https://discuss.elastic.co/t/snmp-collection-setup/85036 "2017-05-10T07:50:58Z")
I am new to ELK, but trying to setup snmp monitoring using ELK. is there any doc or procedure and how to set this up? I can see many pointers to suggesting to use the snmp plugin. Any suggestion will be appreciated. --- ## [Logstash 5.1.2 API returns incorrect values (-1)](https://discuss.elastic.co/t/logstash-5-1-2-api-returns-incorrect-values-1/84926)
**Author:** [@przemek\_danysz](https://discuss.elastic.co/u/przemek_danysz)\ **Replies:** 1\ **Last updated:** [May 10, 2017, 7:34am UTC](https://discuss.elastic.co/t/logstash-5-1-2-api-returns-incorrect-values-1/84926 "2017-05-10T07:34:53Z")
Hi All, I have problem with one of my logstashes. I want to monitoring LS via API, but it returns wrong values for CPU/MEM/etc, as example shows: \[root@mylab\]# curl -s -XGET 'http://127.0.0.1:9600/\_node/stats/process'… --- ## [Nested json field parsing in filter](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 3\ **Last updated:** [May 10, 2017, 7:30am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193 "2017-05-10T07:30:19Z")
I want to split the following data: "ext"=\>{"obj\_ids"=\>\[82748684, 83009084, 81688382, 79158756, 80577703, 83010154, 83022121, 83022241, 82890903, 82451572, 83010197, 83010748, 83010992, 83011106, 83012040, 83030525, 83… --- ## [Json codec vs json filter in file input](https://discuss.elastic.co/t/json-codec-vs-json-filter-in-file-input/84976)
**Author:** [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Replies:** 3\ **Last updated:** [May 10, 2017, 5:37am UTC](https://discuss.elastic.co/t/json-codec-vs-json-filter-in-file-input/84976 "2017-05-10T05:37:30Z")
I have certain log format: \<....\> \[....\] - \[{...},{...},{...}\]. With multi line codec and grok patterns, I was able to extract above into \ \[b\] - c Here c is \[{...},{...},{...}\] including the square brackets \[\] N… --- ## [Logtash-plugin install exetreamly slow, can I copy plugin files make install process easy?](https://discuss.elastic.co/t/logtash-plugin-install-exetreamly-slow-can-i-copy-plugin-files-make-install-process-easy/85069)
**Author:** [@Ryan\_Qian](https://discuss.elastic.co/u/Ryan_Qian)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 11:09am UTC](https://discuss.elastic.co/t/logtash-plugin-install-exetreamly-slow-can-i-copy-plugin-files-make-install-process-easy/85069 "2017-05-09T11:09:01Z")
I have many nodes need install one plugin, can I install one nodes, then copy the files to other nodes? I tried copy whole /usr/share/logstash/vendor folder from already have plugin installed , but logstash-plugin list … --- ## [Field reference failed in logstash-input-redis](https://discuss.elastic.co/t/field-reference-failed-in-logstash-input-redis/84797)
**Author:** [@xiaotie](https://discuss.elastic.co/u/xiaotie)\ **Replies:** 6\ **Last updated:** [May 10, 2017, 2:59am UTC](https://discuss.elastic.co/t/field-reference-failed-in-logstash-input-redis/84797 "2017-05-10T02:59:32Z")
My logstash version is logstash-5.3.2;I use the following config: input { redis { batch\_count =\> 1 data\_type =\> "list" key =\> "monitor\_info\_queue" host =\> "192.168.154.135" por… --- ## [Logstash is not able to consume logs from Kafka](https://discuss.elastic.co/t/logstash-is-not-able-to-consume-logs-from-kafka/85176)
**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\ **Replies:** 0\ **Last updated:** [May 10, 2017, 1:03am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-consume-logs-from-kafka/85176 "2017-05-10T01:03:49Z")
I am trying to consume logs from Kafka with Logstash and forward them to ES. I can see Kafka receives logs from Filebeat but Logstash is not able to consume them, though there are no any errors neither in Kafka nor in… --- ## [Removing CDATA info from parsed log](https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169)
**Author:** [@Kamen\_MacKay](https://discuss.elastic.co/u/Kamen_MacKay)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 11:24pm UTC](https://discuss.elastic.co/t/removing-cdata-info-from-parsed-log/85169 "2017-05-09T23:24:07Z")
I have a xml log file for which I'm trying to extract the XML data from. I'm using the multiline filter in filebeat on the client machine to send it as one block to logstash. It's recognized as XML when Logstash ingests … --- ## [Logstash 5.4 service starts but logging to /var/log/logstash fails](https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161)
**Author:** [@jgforbes](https://discuss.elastic.co/u/jgforbes)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 9:08pm UTC](https://discuss.elastic.co/t/logstash-5-4-service-starts-but-logging-to-var-log-logstash-fails/85161 "2017-05-09T21:08:41Z")
with these errors: systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2017-05-09 16:47… --- ## [Logstash not showing any output to console, hangs on launch (on openstack VM)](https://discuss.elastic.co/t/logstash-not-showing-any-output-to-console-hangs-on-launch-on-openstack-vm/85139)
**Author:** [@Garrett\_Huff](https://discuss.elastic.co/u/Garrett_Huff)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 7:16pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-to-console-hangs-on-launch-on-openstack-vm/85139 "2017-05-09T19:16:38Z")
Hey everyone, I have been following the install process on logstash's getting started guide. It is very strange, on my linux machine it works perfectly fine using either the executable or the debian service. I have spun… --- ## [Help adding field if a condition exists](https://discuss.elastic.co/t/help-adding-field-if-a-condition-exists/85134)
**Author:** [@Tim\_Flowers](https://discuss.elastic.co/u/Tim_Flowers)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 6:36pm UTC](https://discuss.elastic.co/t/help-adding-field-if-a-condition-exists/85134 "2017-05-09T18:36:38Z")
Noob to logstash here, I am trying to do something that I thought would be easy but I am having trouble. I just want to add a field if the syslog\_hostname equals a string or ip address. Here is what I have and when i us… --- ## [Getting logs from a TOOK having \>15ms using logstash?](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 5\ **Last updated:** [May 9, 2017, 6:20pm UTC](https://discuss.elastic.co/t/getting-logs-from-a-took-having-15ms-using-logstash/85103 "2017-05-09T18:20:38Z")
HI, LOGS: \[2017-01-14 10:48:06,848\]\[WARN \]\[index.search.slowlog.query\] \[yaswanth\] \[bank\]\[0\] took\[27.8ms\], took\_millis\[27\], types\[\], stats\[\], search\_type\[QUERY\_THEN\_FETCH\], total\_shards\[5\], source\[\], extra\_source\[\], … --- ## [Stop logstash after processing the file](https://discuss.elastic.co/t/stop-logstash-after-processing-the-file/84959)
**Author:** [@skairam](https://discuss.elastic.co/u/skairam)\ **Replies:** 3\ **Last updated:** [May 9, 2017, 6:18pm UTC](https://discuss.elastic.co/t/stop-logstash-after-processing-the-file/84959 "2017-05-09T18:18:32Z")
Hi all, I have a shell script which will be triggered when ever a new file is arrived into a folder called inbound. logstash process needs to be started to read and load the file contents into elastic. I am able to … --- ## [Non recoverable exception while writing to InfluxDB](https://discuss.elastic.co/t/non-recoverable-exception-while-writing-to-influxdb/85119)
**Author:** [@randahlem](https://discuss.elastic.co/u/randahlem)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 3:02pm UTC](https://discuss.elastic.co/t/non-recoverable-exception-while-writing-to-influxdb/85119 "2017-05-09T15:02:11Z")
Hi, i am very confused with the InfluxDB plugin for logstash. I used all sorts of plugins for logtash, i tried the basic configuration (according to the logstash docs) for the InfluxDB but i am completely lost by the m… --- ## [Error after upgrading to ELK 5](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091)
**Author:** [@RustuGurkan](https://discuss.elastic.co/u/RustuGurkan)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 1:52pm UTC](https://discuss.elastic.co/t/error-after-upgrading-to-elk-5/85091 "2017-05-09T13:52:30Z")
Hi, I've upgraded to ELK 5 so now everything is in the 5 version but after the upgrade ELK stopped recieving logs when I put this command curl -XGET 'http://localhost:9200/filebeat-\*/\_search?pretty' I'm getting a hit… --- ## [Docker gelf udp to logstash-elasticsearch-kibana](https://discuss.elastic.co/t/docker-gelf-udp-to-logstash-elasticsearch-kibana/85115)
**Author:** [@justinbleach](https://discuss.elastic.co/u/justinbleach)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 2:54pm UTC](https://discuss.elastic.co/t/docker-gelf-udp-to-logstash-elasticsearch-kibana/85115 "2017-05-09T14:54:11Z")
I need someone to please verify my simple config because I'm not seeing the logs in Kibana like I thought. It's very simple; here's what I have. I would think the container I run on the daemon; whatever it logs would end… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=985) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=987)