# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=987 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 988 --- ## [Unhelpful error message](https://discuss.elastic.co/t/unhelpful-error-message/85116)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 2:36pm UTC](https://discuss.elastic.co/t/unhelpful-error-message/85116 "2017-05-09T14:36:56Z")
Considering the verbosity of running Logstash at 'info' level logging, I've set ours just to 'warn'. I'm seeing this error message though: \[2017-05-09T14:16:39,801\]\[ERROR\]\[logstash.outputs.elasticsearch\] Action \[2017… --- ## [Logstash Yum Repo down?](https://discuss.elastic.co/t/logstash-yum-repo-down/84599)
**Author:** [@duxy007](https://discuss.elastic.co/u/duxy007)\ **Replies:** 12\ **Last updated:** [May 9, 2017, 1:06pm UTC](https://discuss.elastic.co/t/logstash-yum-repo-down/84599 "2017-05-09T13:06:38Z")
I am trying to install logstash from the yum repo. Instructions say to point at https://artifacts.elastic.co/packages/5.3/yum. This does not seem to be available when you go to the URL. When running the yum command I… --- ## [Configuration error - Transcribing auditd ingest pipeline to logstash config](https://discuss.elastic.co/t/configuration-error-transcribing-auditd-ingest-pipeline-to-logstash-config/84985)
**Author:** [@jeffspahr](https://discuss.elastic.co/u/jeffspahr)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 12:28pm UTC](https://discuss.elastic.co/t/configuration-error-transcribing-auditd-ingest-pipeline-to-logstash-config/84985 "2017-05-09T12:28:39Z")
I'm attempting to transcribe the auditd ingest pipeline from the filebeat module to a logstash config, and I'm hitting the following config syntax error. Any idea what I'm missing? \[2017-05-08T18:05:19,699\]\[FATAL\]… --- ## [About my recently submitted new plugins - qingstor](https://discuss.elastic.co/t/about-my-recently-submitted-new-plugins-qingstor/85087)
**Author:** [@Tacinight](https://discuss.elastic.co/u/Tacinight)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 12:28pm UTC](https://discuss.elastic.co/t/about-my-recently-submitted-new-plugins-qingstor/85087 "2017-05-09T12:28:04Z")
Hi, I've submitted a pair of plugins and opened issues in github. It's been one week ago and I haven't hear any responses. I'm also noticed that a quiet number of plugins are under processing, So may I ask when will it c… --- ## [Ruby code to split array message and get the index and value in logstash](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 12:08pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075 "2017-05-09T12:08:47Z")
I am new to ruby code. Will appreciate any help on this. my input is message =\> field id=\\"0\\" value=\\"01\\"/\>\\n field id=\\"3\\" value=\\"03\\"/\>\\n \Logstash problem with "LocationInfo is not allowed" exception](https://discuss.elastic.co/t/log4j-logstash-problem-with-locationinfo-is-not-allowed-exception/85054)
**Author:** [@iknowabc](https://discuss.elastic.co/u/iknowabc)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 9:52am UTC](https://discuss.elastic.co/t/log4j-logstash-problem-with-locationinfo-is-not-allowed-exception/85054 "2017-05-09T09:52:19Z")
When I use log4j sends log event to Logstash , a problem ("exception=\>java.io.InvalidObjectException: Object type org.apache.log4j.spi.LocationInfo is not allowed.") is encountered. Anyone could help me ? thanks! BTW: Bo… --- ## [Logstash sending slowlog to emails?](https://discuss.elastic.co/t/logstash-sending-slowlog-to-emails/85050)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-sending-slowlog-to-emails/85050 "2017-05-09T09:14:09Z")
Hi, Slowlog: \[2016-03-23 06:43:47,231\]\[DEBUG\]\[index.search.slowlog.fetch\] took\[5.8ms\], took\_millis\[5\], types\[talk\], stats\[\], search\_type\[QUERY\_THEN\_FETCH\], total\_shards\[5\], source\[{"query":{"match":{"tags":"Java"… --- ## [Any idea?](https://discuss.elastic.co/t/any-idea/85032)
**Author:** [@Saplog](https://discuss.elastic.co/u/Saplog)\ **Replies:** 11\ **Last updated:** [May 9, 2017, 9:04am UTC](https://discuss.elastic.co/t/any-idea/85032 "2017-05-09T09:04:49Z")
Hello guys, I had specific log like that: Fri Mar 18 14:06:17 2016 DISCONNECT C2075/2319 host 192.168.44.1/32949 (192.168.44.1) Fri Mar 18 14:06:17 2016 DISCONNECT C610/3117 host 192.168.44.1/24080 (192.168.44.1) Fri… --- ## [Logstash exits after less than a minute?](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035)
**Author:** [@BrunoC](https://discuss.elastic.co/u/BrunoC)\ **Replies:** 6\ **Last updated:** [May 9, 2017, 8:48am UTC](https://discuss.elastic.co/t/logstash-exits-after-less-than-a-minute/85035 "2017-05-09T08:48:48Z")
Hi guys, I'm having a big problem, when I start Logstash's service it exits after a few seconds. (When checking it's statut it says "active (exited)", I managed to have it run for a few hours last week but now it's ju… --- ## [Unable to fetch mapping - logstash](https://discuss.elastic.co/t/unable-to-fetch-mapping-logstash/85037)
**Author:** [@avdnowhere](https://discuss.elastic.co/u/avdnowhere)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 8:47am UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping-logstash/85037 "2017-05-09T08:47:18Z")
Dear All, I have 'Unable to fetch mapping. Do you have indices matching the pattern?' error Kibana: I tried to find a solution from the Internet, it seems that I don't have logstash. So download the logstash and tri… --- ## [Why log4j plugin for logstash is deprecated?](https://discuss.elastic.co/t/why-log4j-plugin-for-logstash-is-deprecated/85033)
**Author:** [@iknowabc](https://discuss.elastic.co/u/iknowabc)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 8:24am UTC](https://discuss.elastic.co/t/why-log4j-plugin-for-logstash-is-deprecated/85033 "2017-05-09T08:24:39Z")
Hello, I want to use log4j for my application to write the log via stream mode to logstash by its log4j plugin. But from website below: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html it tell… --- ## [Logstash split String](https://discuss.elastic.co/t/logstash-split-string/84946)
**Author:** [@Thomas-cc](https://discuss.elastic.co/u/Thomas-cc)\ **Replies:** 1\ **Last updated:** [May 8, 2017, 2:47pm UTC](https://discuss.elastic.co/t/logstash-split-string/84946 "2017-05-08T14:47:07Z")
Hallo all togehter, i have build a new instance with icinga-beat-\>logstash-\>elasticsearch-\>kibana (all with the newest version) Everything works fine, but i have a litte problem with split one string to an array. T… --- ## [Input plugin for kafka](https://discuss.elastic.co/t/input-plugin-for-kafka/85021)
**Author:** [@ymunakata](https://discuss.elastic.co/u/ymunakata)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 7:00am UTC](https://discuss.elastic.co/t/input-plugin-for-kafka/85021 "2017-05-09T07:00:33Z")
Does anyone use logstash input plugin for Kafka? I try to consume data in Kafka with Kafka input plugin. logstash -debug prints it seems that logstash.conf has been loaded and logstash starts properly. After that logs… --- ## [Get timestamp, date and time fields in date format in logstash](https://discuss.elastic.co/t/get-timestamp-date-and-time-fields-in-date-format-in-logstash/85020)
**Author:** [@gautamv](https://discuss.elastic.co/u/gautamv)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 6:50am UTC](https://discuss.elastic.co/t/get-timestamp-date-and-time-fields-in-date-format-in-logstash/85020 "2017-05-09T06:50:30Z")
I'm trying to plot date histograms in kibana 5 for each day. Therefore, I want the x-axis to be just the time. Right now, I have a @timestamp field, which has the datetime captured as 2017-04-17T20:12:47.221Z. I'm captur… --- ## [Working on parsing an AWSTATS log from a Windows based mailserver. I've been stuck for 3 days, can anyone please take a peek?](https://discuss.elastic.co/t/working-on-parsing-an-awstats-log-from-a-windows-based-mailserver-ive-been-stuck-for-3-days-can-anyone-please-take-a-peek/85011)
**Author:** [@jaron](https://discuss.elastic.co/u/jaron)\ **Replies:** 0\ **Last updated:** [May 9, 2017, 5:18am UTC](https://discuss.elastic.co/t/working-on-parsing-an-awstats-log-from-a-windows-based-mailserver-ive-been-stuck-for-3-days-can-anyone-please-take-a-peek/85011 "2017-05-09T05:18:22Z")
EDIT: the "\\t"'s that appear on this page are all supposed to be double slashes. I can't really figure out how to correct them all on this page but if I'm missing any in these filters its probably a formatting issue inst… --- ## [Logstash to Logstash?](https://discuss.elastic.co/t/logstash-to-logstash/84865)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 8\ **Last updated:** [May 9, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-to-logstash/84865 "2017-05-09T05:18:47Z")
Hi, Is it possible to feed Logstash data into another Logstash instance that connects to Elastic? In my configuration I will have many remote locations hooked up to expensive satellite connections that I want to send… --- ## [No output received in elasticsearch](https://discuss.elastic.co/t/no-output-received-in-elasticsearch/84918)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 1:20am UTC](https://discuss.elastic.co/t/no-output-received-in-elasticsearch/84918 "2017-05-09T01:20:26Z")
I've got the following debug info 18:40:43.230 \[\[main\]\>worker1\] DEBUG logstash.pipeline - output received {"event"=\>{"gender"=\>"", "type"=\>"report\_video", "author\_version"=\>"None", "platform"=\>"weixin", "\_ext"=\>{"conte… --- ## [Add new field base on existing filed](https://discuss.elastic.co/t/add-new-field-base-on-existing-filed/84894)
**Author:** [@Ryan\_Qian](https://discuss.elastic.co/u/Ryan_Qian)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 1:04am UTC](https://discuss.elastic.co/t/add-new-field-base-on-existing-filed/84894 "2017-05-09T01:04:42Z")
I need extract a field from log file, then take this field to query DB (or redis or whatever a service I write), then add this result as a new field. which filter should I use? or I have to write my own plugin? --- ## [Elasticsearch input plugin query error](https://discuss.elastic.co/t/elasticsearch-input-plugin-query-error/84991)
**Author:** [@chg](https://discuss.elastic.co/u/chg)\ **Replies:** 0\ **Last updated:** [May 8, 2017, 11:35pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-query-error/84991 "2017-05-08T23:35:19Z")
I have a working elasticsearch query I would like to run and reinsert the results back into elasticsearch. I am using the elasticsearch input plugin in my logstash config file. I have a query that contains aggregations … --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/84983)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [May 8, 2017, 9:27pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/84983 "2017-05-08T21:27:00Z")
I keep getting flooded with following messages inside of my /var/log/logstash/logstash-plain.log: \[2017-05-08T21:24:21,589\]\[INFO \]\[logstash.outputs.elasticsearch\] Running health check to see if an Elasticsearch connect… --- ## [Regex for redis logs](https://discuss.elastic.co/t/regex-for-redis-logs/84968)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 3\ **Last updated:** [May 8, 2017, 8:30pm UTC](https://discuss.elastic.co/t/regex-for-redis-logs/84968 "2017-05-08T20:30:36Z")
I have made a regex for redis logs. I have tested it at http://regexr.com/ but it is not working in logstash. Here is a log entry from redis logs, 30200:C 06 May 21:25:10.186 \* RDB: 6 MB of memory used by copy-on-wr… --- ## [Syslog input from multiple apps](https://discuss.elastic.co/t/syslog-input-from-multiple-apps/84952)
**Author:** [@lgee](https://discuss.elastic.co/u/lgee)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 7:39pm UTC](https://discuss.elastic.co/t/syslog-input-from-multiple-apps/84952 "2017-05-08T19:39:45Z")
I'm looking to set up a logstash instance that receives syslog input from a number (~ 10) web apps. What is the best solution for identifying the source of each log? Ultimately I'd like an application field that identi… --- ## [Logstash with Splunk](https://discuss.elastic.co/t/logstash-with-splunk/38269)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 7:27pm UTC](https://discuss.elastic.co/t/logstash-with-splunk/38269 "2017-05-08T19:27:01Z")
Hello All, Is it possible to configure Logstash to send logs (windows event log ) to Splunk to get events after logstash parsing? Tnx in advance --- ## [Trivial syslog processing not working](https://discuss.elastic.co/t/trivial-syslog-processing-not-working/84848)
**Author:** [@dcn](https://discuss.elastic.co/u/dcn)\ **Replies:** 15\ **Last updated:** [May 8, 2017, 5:48pm UTC](https://discuss.elastic.co/t/trivial-syslog-processing-not-working/84848 "2017-05-08T17:48:25Z")
I'm sorry to post here if the answer is finally trivial too, but I've now past countless hours reading everywhere trying to solve it. I'm basically sending syslog message to Logstash: input { tcp { … --- ## [CSV output not working properly after upgrade from 5.3.1 to 5.4.0](https://discuss.elastic.co/t/csv-output-not-working-properly-after-upgrade-from-5-3-1-to-5-4-0/84936)
**Author:** [@fxiger](https://discuss.elastic.co/u/fxiger)\ **Replies:** 3\ **Last updated:** [May 8, 2017, 3:36pm UTC](https://discuss.elastic.co/t/csv-output-not-working-properly-after-upgrade-from-5-3-1-to-5-4-0/84936 "2017-05-08T15:36:58Z")
Hi, i'm using an ELK stack (now) at 5.4.0 on a debian machine and had before version 5.3.1 running. my usecase: read from rabbitMQ and depending on filter either put events directly into an ES index or output specific … --- ## [Sorry if its repeated question about parsing logs from diffrent directories and diffrent indexes](https://discuss.elastic.co/t/sorry-if-its-repeated-question-about-parsing-logs-from-diffrent-directories-and-diffrent-indexes/84940)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 3:07pm UTC](https://discuss.elastic.co/t/sorry-if-its-repeated-question-about-parsing-logs-from-diffrent-directories-and-diffrent-indexes/84940 "2017-05-08T15:07:59Z")
Hi on my web server I have following configuration for access log location : /var/log/customerA/access.log location : /var/log/customerB/access.log location : /var/log/customerC/access.log So i think i need only o… --- ## [Problem updating logs using elasticsearch ouput](https://discuss.elastic.co/t/problem-updating-logs-using-elasticsearch-ouput/84947)
**Author:** [@Vittorio](https://discuss.elastic.co/u/Vittorio)\ **Replies:** 0\ **Last updated:** [May 8, 2017, 2:52pm UTC](https://discuss.elastic.co/t/problem-updating-logs-using-elasticsearch-ouput/84947 "2017-05-08T14:52:32Z")
Hello everybody, I'm not finding a solution to this problem: using http\_poller as input plugin, an elasticsearch filter to match log and enrich with some data, output elastic search for update the log. here's the c… --- ## [NPE with LS 5.4.0 logstash-plugin when env vars "http(s)\_proxy" set but empty](https://discuss.elastic.co/t/npe-with-ls-5-4-0-logstash-plugin-when-env-vars-http-s--proxy-set-but-empty/84845)
**Author:** [@jupp](https://discuss.elastic.co/u/jupp)\ **Replies:** 3\ **Last updated:** [May 8, 2017, 1:25pm UTC](https://discuss.elastic.co/t/npe-with-ls-5-4-0-logstash-plugin-when-env-vars-http-s--proxy-set-but-empty/84845 "2017-05-08T13:25:06Z")
Hi Folks, i get following error when i try to execute logstash-plugin: jupp@jupp-laptop-e530:~/entwicklung/software/elastic/5.4.0/logstash-5.4.0$ bin/logstash-plugin java/util/Hashtable.java:459:in \`put': java.lang.… --- ## [Logstash http server custom log format which includes values set in header](https://discuss.elastic.co/t/logstash-http-server-custom-log-format-which-includes-values-set-in-header/84647)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 3\ **Last updated:** [May 8, 2017, 12:38pm UTC](https://discuss.elastic.co/t/logstash-http-server-custom-log-format-which-includes-values-set-in-header/84647 "2017-05-08T12:38:53Z")
Hi I have following LogFormat for my apache http server. LogFormat "%h %l %u %t \\"%r\\" %\>s %b %D \\"%{Referer}i\\" \\"%{User-Agent}i\\" \\"%{JWT-elapsed-time}i\\" \\"%{userID}i\\" \\"%{userRole}o\\" \\"%{localServiceAddress}i… --- ## [Add field with logstash in csv file](https://discuss.elastic.co/t/add-field-with-logstash-in-csv-file/84919)
**Author:** [@zegdene](https://discuss.elastic.co/u/zegdene)\ **Replies:** 1\ **Last updated:** [May 8, 2017, 12:08pm UTC](https://discuss.elastic.co/t/add-field-with-logstash-in-csv-file/84919 "2017-05-08T12:08:08Z")
Hi, I create a file config.conf to insert data.csv in elasticsearch i need to remove filed and add in empty filed this is my config.conf: input { file { path =\> "/home/salma/Documents/data.csv" start\_posi… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=986) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=988)