# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=993 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 994 --- ## [New TCP input plugin cannot return SSL certificate information](https://discuss.elastic.co/t/new-tcp-input-plugin-cannot-return-ssl-certificate-information/83910)
**Author:** [@DravenJohnson](https://discuss.elastic.co/u/DravenJohnson)\ **Replies:** 0\ **Last updated:** [April 27, 2017, 5:19pm UTC](https://discuss.elastic.co/t/new-tcp-input-plugin-cannot-return-ssl-certificate-information/83910 "2017-04-27T17:19:10Z")
We just upgraded logstash to 5.x version and we noticed this issue today that TCP connection won't get any certificate information if there is one established connection already. openssl s\_client return this: CONNE… --- ## [Distinguish between syslog inputs](https://discuss.elastic.co/t/distinguish-between-syslog-inputs/83877)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 4:35pm UTC](https://discuss.elastic.co/t/distinguish-between-syslog-inputs/83877 "2017-04-27T16:35:04Z")
Hello, can anyone tell me how I would distinguish between two different syslog sources in Logstash, for example one source being a firewall device and another being an ESXi host? I know you can use tags but as I can't in… --- ## [Logstash Stopping Silently at the backgrounnd](https://discuss.elastic.co/t/logstash-stopping-silently-at-the-backgrounnd/83826)
**Author:** [@farazkhan](https://discuss.elastic.co/u/farazkhan)\ **Replies:** 1\ **Last updated:** [April 27, 2017, 4:32pm UTC](https://discuss.elastic.co/t/logstash-stopping-silently-at-the-backgrounnd/83826 "2017-04-27T16:32:08Z")
Hi I am using Logstash 2.4.0 . I am getting below error in the logs. {"thread\_id"=\>51, "name"=\>"\[main\]\>worker22", "plugin"=\>nil, "current\_call"=\>" \[...\]/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstas… --- ## [How to change data type for date field?](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843)
**Author:** [@Ish\_Sookun](https://discuss.elastic.co/u/Ish_Sookun)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 3:54pm UTC](https://discuss.elastic.co/t/how-to-change-data-type-for-date-field/28843 "2017-04-27T15:54:50Z")
Hello, Is there anyone around who got a 'date' field as 'string'? Anyway to change the data type to 'date'? I need something like this: { "data" : { "properties" : { "date": { "type" : "date", "format" : "yyyy-MM-dd … --- ## [Netflow support for Brocade Vyatta routers](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547)
**Author:** [@Amir\_Gohar](https://discuss.elastic.co/u/Amir_Gohar)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 3:14pm UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547 "2017-04-26T15:14:02Z")
can logstash plugin for netflow support vyatta routers as well ? i am able see my CISCO devices data on elk stack but not able to see the vyatta routers related data, i am aware of the supported exporters list that netf… --- ## [Troubleshooting too many "Beats input: the pipeline is blocked" messages](https://discuss.elastic.co/t/troubleshooting-too-many-beats-input-the-pipeline-is-blocked-messages/83613)
**Author:** [@elkwil](https://discuss.elastic.co/u/elkwil)\ **Replies:** 2\ **Last updated:** [April 27, 2017, 3:04pm UTC](https://discuss.elastic.co/t/troubleshooting-too-many-beats-input-the-pipeline-is-blocked-messages/83613 "2017-04-27T15:04:47Z")
Hi, I have a 4 vCPU, 32GB ram systems with logstash running. I am trying to find my bottleneck and am new to ELK. For the most part, things work OK, but over the day the logs get about 10-20 minutes behind real time. S… --- ## [How to install the translate plugin without internet access](https://discuss.elastic.co/t/how-to-install-the-translate-plugin-without-internet-access/83880)
**Author:** [@alonl1000](https://discuss.elastic.co/u/alonl1000)\ **Replies:** 0\ **Last updated:** [April 27, 2017, 2:22pm UTC](https://discuss.elastic.co/t/how-to-install-the-translate-plugin-without-internet-access/83880 "2017-04-27T14:22:12Z")
Hi, The offline installation procedure still try to connect gems site, logstash-filter-translate I tried to use the -- local and the new procedure both failed. Regards Alon. --- ## [Draw error on logstash graphs skewing scale](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708)
**Author:** [@\_Ian](https://discuss.elastic.co/u/_Ian)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 2:17pm UTC](https://discuss.elastic.co/t/draw-error-on-logstash-graphs-skewing-scale/83708 "2017-04-27T14:17:06Z")
While watching a live tail of the events rate in the Logstash montitor the graphs are often broken by a render problem. It seems a large value is selected as the first datapoint (invalid) which throws off the graph dra… --- ## [Problem while use multiline in logstash 5.3.1](https://discuss.elastic.co/t/problem-while-use-multiline-in-logstash-5-3-1/83866)
**Author:** [@manopmk](https://discuss.elastic.co/u/manopmk)\ **Replies:** 0\ **Last updated:** [April 27, 2017, 12:53pm UTC](https://discuss.elastic.co/t/problem-while-use-multiline-in-logstash-5-3-1/83866 "2017-04-27T12:53:08Z")
Hi Buddy im using logstash 5.3.1 my conf is input { file { path =\> "C:/pratik/Digital/softwares/logs/search.log" start\_position =\> "beginning" codec =\> multiline { # Grok pattern names are valid!… --- ## [Unrecognised option '--path.setting'](https://discuss.elastic.co/t/unrecognised-option-path-setting/83837)
**Author:** [@DOB](https://discuss.elastic.co/u/DOB)\ **Replies:** 1\ **Last updated:** [April 27, 2017, 10:15am UTC](https://discuss.elastic.co/t/unrecognised-option-path-setting/83837 "2017-04-27T10:15:44Z")
When running logstash directly I always get this warning message: WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Con… --- ## [/etc/init.d/logstash force-stop failed!](https://discuss.elastic.co/t/etc-init-d-logstash-force-stop-failed/83815)
**Author:** [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Replies:** 2\ **Last updated:** [April 27, 2017, 8:28am UTC](https://discuss.elastic.co/t/etc-init-d-logstash-force-stop-failed/83815 "2017-04-27T08:28:45Z")
os: centos6.9 elastic stack lastest version yum install when logstash start ,I configure all elk \*.yml, the logstash also error, when I kill logstash pid, logstash will auto start. I can't find how to logstash auto res… --- ## [Read log files from the http url](https://discuss.elastic.co/t/read-log-files-from-the-http-url/83649)
**Author:** [@Hareesh](https://discuss.elastic.co/u/Hareesh)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 7:34am UTC](https://discuss.elastic.co/t/read-log-files-from-the-http-url/83649 "2017-04-27T07:34:19Z")
I am trying to read the log file from a remote location. Example, All log files are available in the below url: http://host\_name:port/path1/path2 And the log file name would be as follows (Time format) web\_server… --- ## [A little help needed on parsing xml](https://discuss.elastic.co/t/a-little-help-needed-on-parsing-xml/83784)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 7\ **Last updated:** [April 27, 2017, 7:33am UTC](https://discuss.elastic.co/t/a-little-help-needed-on-parsing-xml/83784 "2017-04-27T07:33:30Z")
Hi, I might need a few ideas here to start off with Logstash. I am pulling data from Microsoft SQL server. And one of the fields returned is an XML. This is a representation of the xml. \ **Author:** [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Replies:** 6\ **Last updated:** [April 27, 2017, 7:12am UTC](https://discuss.elastic.co/t/someone-please-clarify-me-on-my-configuration/83789 "2017-04-27T07:12:05Z") Hi All, I am getting bit confusion on type,field. Could you please someone confirm me by checking below configuration. My intention is to create the index by environment wise and remove some fields from the output… --- ## [Output to indices based on field in message](https://discuss.elastic.co/t/output-to-indices-based-on-field-in-message/83719)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 5:34am UTC](https://discuss.elastic.co/t/output-to-indices-based-on-field-in-message/83719 "2017-04-27T05:34:54Z")
I have some logs have same filenames like access\_20170427.log, then content in it is like \[{user\_id:123, act:play, timestamp:2017-04-23 08:00:00},{user\_id:456, act:play, timestamp:2017-04-23 08:00:00}\] I want to put them… --- ## [Pattern for the Below Timestamp](https://discuss.elastic.co/t/pattern-for-the-below-timestamp/83731)
**Author:** [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 5:17am UTC](https://discuss.elastic.co/t/pattern-for-the-below-timestamp/83731 "2017-04-27T05:17:47Z")
Hello, I have a timestamp like this"2017-03-27 17:00:27,352 -0500". Tried using TIMESTAMP\_ISO8601 but it doesnt pick up timezone part . So I tried using a pattern which looks like "YYYY-MM-dd HH:mm:ss,SSS zZ" and it … --- ## [KV Filter Question](https://discuss.elastic.co/t/kv-filter-question/82702)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 20\ **Last updated:** [April 27, 2017, 5:16am UTC](https://discuss.elastic.co/t/kv-filter-question/82702 "2017-04-27T05:16:40Z")
Hi, I can now succesfully recieve Logs from my Synology. Now i have to add some fields. At the moment i don't have everything as a field in Kibana. So in Kibana the message contains the import information. The messag… --- ## [Logstash As Side Car Container](https://discuss.elastic.co/t/logstash-as-side-car-container/82982)
**Author:** [@Java\_Padawan](https://discuss.elastic.co/u/Java_Padawan)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-as-side-car-container/82982 "2017-04-27T05:15:05Z")
I've been using logstash 2.x as a side car for a microservice container. And I facing an issue where it consumes a lot of resources. 1.4GB Ram and almost 2000 millicores for one of the most active microservice. Not gi… --- ## [Strange observation in ELK](https://discuss.elastic.co/t/strange-observation-in-elk/83655)
**Author:** [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Replies:** 3\ **Last updated:** [April 27, 2017, 3:24am UTC](https://discuss.elastic.co/t/strange-observation-in-elk/83655 "2017-04-27T03:24:36Z")
Hi All, I have created configuration in logstash and able to saw the logs in kibana with huge content like 7 lakh lines. Then i have separated the same data into parts with 1 lakh lines in each file and made 7 log f… --- ## [Logs are not displaying with event wise](https://discuss.elastic.co/t/logs-are-not-displaying-with-event-wise/83643)
**Author:** [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 3:21am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-with-event-wise/83643 "2017-04-27T03:21:58Z")
Hi All, I am facing the strange issue, I am seeing the logs in file is 693400 lines but i am seeing 2222419 lines of logs in Kibana. Dont know how it was taken from my log file. I used multiline also but still the same… --- ## [Import csv file to elasticsearch using logstash](https://discuss.elastic.co/t/import-csv-file-to-elasticsearch-using-logstash/83682)
**Author:** [@zegdene](https://discuss.elastic.co/u/zegdene)\ **Replies:** 12\ **Last updated:** [April 26, 2017, 3:57pm UTC](https://discuss.elastic.co/t/import-csv-file-to-elasticsearch-using-logstash/83682 "2017-04-26T15:57:25Z")
Hi, I need to import a csv file to elasticsearch using logstash, i create a file.config: input { file { path =\> "/Users/salma/Desktop/creditcard.csv" start\_position =\> "beginning" since… --- ## [Introduce tab in a message field](https://discuss.elastic.co/t/introduce-tab-in-a-message-field/83697)
**Author:** [@ddebast](https://discuss.elastic.co/u/ddebast)\ **Replies:** 1\ **Last updated:** [April 26, 2017, 3:37pm UTC](https://discuss.elastic.co/t/introduce-tab-in-a-message-field/83697 "2017-04-26T15:37:30Z")
Hello, I need to reconstruct a field and want to introduce a horizontal tab (\\t, 0x09). Within the filter part I set the following mutate { replace =\> { "message" =\> "hello\\tWorld" } } But this is not working. As… --- ## [Logstash aggregate complicated, please help](https://discuss.elastic.co/t/logstash-aggregate-complicated-please-help/83701)
**Author:** [@deatheros](https://discuss.elastic.co/u/deatheros)\ **Replies:** 1\ **Last updated:** [April 26, 2017, 3:31pm UTC](https://discuss.elastic.co/t/logstash-aggregate-complicated-please-help/83701 "2017-04-26T15:31:27Z")
Hi there I'm trying to create aggregation filter for my email exim logs. Can you help me? Basically I have logs like these: 2017-04-10 00:00:30 1cxKsn-0001GB-2t CTAS=IN RefID= ( ISpam= IFlags=v=2.2 cv=Op4/823t c=1 sm… --- ## [Use information of first line in the rest of the file](https://discuss.elastic.co/t/use-information-of-first-line-in-the-rest-of-the-file/83115)
**Author:** [@thix](https://discuss.elastic.co/u/thix)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 3:25pm UTC](https://discuss.elastic.co/t/use-information-of-first-line-in-the-rest-of-the-file/83115 "2017-04-26T15:25:22Z")
Hi, everyone. First of all I'd like to do two things: Apologize to all about my bad English. Congratulate you about this amazing project (ELK). My case is.... I have millions of text files with the following s… --- ## [Logstash not reading config file when ran as a service](https://discuss.elastic.co/t/logstash-not-reading-config-file-when-ran-as-a-service/83605)
**Author:** [@runatyr](https://discuss.elastic.co/u/runatyr)\ **Replies:** 19\ **Last updated:** [April 26, 2017, 2:40pm UTC](https://discuss.elastic.co/t/logstash-not-reading-config-file-when-ran-as-a-service/83605 "2017-04-26T14:40:21Z")
Hello again all. Thank you so much for your help on my previous question. Hopefully this is my last (lol almost got that out with a straight face) When I run the command line on my redhat box ./logstash -f /usr/share… --- ## [Issues with kafka input 4.2 and logstash 5.3.0](https://discuss.elastic.co/t/issues-with-kafka-input-4-2-and-logstash-5-3-0/83703)
**Author:** [@amit\_oren](https://discuss.elastic.co/u/amit_oren)\ **Replies:** 0\ **Last updated:** [April 26, 2017, 1:02pm UTC](https://discuss.elastic.co/t/issues-with-kafka-input-4-2-and-logstash-5-3-0/83703 "2017-04-26T13:02:48Z")
Hi, I am trying to create a pipeline with Kafka 0.9 as input. As far as I understand, I've got to use the 4.x.x version of the input. I've removed and installed the proper version and tried running the pipeline, but ran… --- ## [Multiple match option in grok](https://discuss.elastic.co/t/multiple-match-option-in-grok/83590)
**Author:** [@Darya\_Semenova](https://discuss.elastic.co/u/Darya_Semenova)\ **Replies:** 7\ **Last updated:** [April 26, 2017, 12:01pm UTC](https://discuss.elastic.co/t/multiple-match-option-in-grok/83590 "2017-04-26T12:01:26Z")
I have a question about several matches in grok filter. Am I right to assume that with multiple matches, even if the log will be parsed successfully by one of them, it will still be \_grokparsefailure in tags, cause of mi… --- ## [How to map between extracted fields](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601)
**Author:** [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\ **Replies:** 3\ **Last updated:** [April 26, 2017, 9:32am UTC](https://discuss.elastic.co/t/how-to-map-between-extracted-fields/83601 "2017-04-26T09:32:55Z")
Hello, I am extracting info from logfiles, but I want to map them together for aggregations, here's a sample logfile: 2017-01-01 07:53:44 \[monitor\_utils.py\] INFO: Crawled iteration for merchant ariika started 2017-01-0… --- ## [How to parse tomcat application logs](https://discuss.elastic.co/t/how-to-parse-tomcat-application-logs/83515)
**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\ **Replies:** 5\ **Last updated:** [April 26, 2017, 9:16am UTC](https://discuss.elastic.co/t/how-to-parse-tomcat-application-logs/83515 "2017-04-26T09:16:10Z")
Hi Guyz, I am new here i am trying to parse my tomcat application logs using grok filter but it does'nt work. Basically, I'm reading a log file using filebeat and send to logstash. and logstash i used for filtering. i… --- ## [How to make the JMX plugin work?](https://discuss.elastic.co/t/how-to-make-the-jmx-plugin-work/83591)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 1\ **Last updated:** [April 26, 2017, 8:27am UTC](https://discuss.elastic.co/t/how-to-make-the-jmx-plugin-work/83591 "2017-04-26T08:27:28Z")
Completely new to Elastic stack, just playing around, to see how easy it might be to do the sorts of things we're likely to want. I've tried to use the JMX plugin, but get the following in the log. It appears to be fai… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=992) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=994)