# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=996 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 997 --- ## [Error parsing CSV - Illegal quoting with non-ascii (default)](https://discuss.elastic.co/t/error-parsing-csv-illegal-quoting-with-non-ascii-default/83279)
**Author:** [@niels1189](https://discuss.elastic.co/u/niels1189)\ **Replies:** 1\ **Last updated:** [April 22, 2017, 3:37pm UTC](https://discuss.elastic.co/t/error-parsing-csv-illegal-quoting-with-non-ascii-default/83279 "2017-04-22T15:37:57Z")
CSV Line: "Mañe"###"email@gmail.com"###"3563454"###"255.255.255.255" :source=\>"\\\\\\"Man\\\\xF1e\\\\\\"###\\\\\\"email@gmail.com\\\\\\"###\\\\\\"3563454\\\\\\"###\\\\\\"255.255.255.255\\\\\\"",:exception=\># CSV::MalformedCSVError: Illegal quot… --- ## [Connect logstash with Cassandra and send data to Elastic](https://discuss.elastic.co/t/connect-logstash-with-cassandra-and-send-data-to-elastic/82912)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 2\ **Last updated:** [April 22, 2017, 11:21am UTC](https://discuss.elastic.co/t/connect-logstash-with-cassandra-and-send-data-to-elastic/82912 "2017-04-22T11:21:36Z")
Hi Team : I am trying to import data from Cassandra to Elastic using logstash jdbc , but I am getting an error as org.apache.cassandra.cql.jdbc.CassandraDriver not loaded. where as I added the jar and class path as below… --- ## [Xpack monitoring: logstash heap size](https://discuss.elastic.co/t/xpack-monitoring-logstash-heap-size/83266)
**Author:** [@sunwl](https://discuss.elastic.co/u/sunwl)\ **Replies:** 0\ **Last updated:** [April 22, 2017, 5:51am UTC](https://discuss.elastic.co/t/xpack-monitoring-logstash-heap-size/83266 "2017-04-22T05:51:38Z")
Hi there, It seems that the logstash heap size from the monitoring dashboard is the double of the real size. I set XMX4G in logstash jvm.options and I found the max heap size from kibana monitoring is 7.8G. I am using … --- ## [How to ignore fields is null when I combine them?](https://discuss.elastic.co/t/how-to-ignore-fields-is-null-when-i-combine-them/83235)
**Author:** [@chianingwang](https://discuss.elastic.co/u/chianingwang)\ **Replies:** 0\ **Last updated:** [April 21, 2017, 5:12pm UTC](https://discuss.elastic.co/t/how-to-ignore-fields-is-null-when-i-combine-them/83235 "2017-04-21T17:12:07Z")
This is my grok pattern add\_field =\> { if \[referer\_url\] == "-" "referer" =\> "%{referer\_req\_method} %{referer\_url}%{referer\_url\_querystring}" } e.g: this is perfect case t referer GET h… --- ## ["Verbose" timezone](https://discuss.elastic.co/t/verbose-timezone/83103)
**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 1:38pm UTC](https://discuss.elastic.co/t/verbose-timezone/83103 "2017-04-21T13:38:41Z")
Hi all, I'm trying to create a grok statement for an httpd "access" log with entries like the following: 127.0.0.1 - - 2017-04-20 02:15:42.369 Pacific Daylight Time 80 "HEAD /favicon.ico HTTP/1.1" "-" 200 - "-" 1004 WP… --- ## [How to change log files indexing between Logstash and Elasticsearch](https://discuss.elastic.co/t/how-to-change-log-files-indexing-between-logstash-and-elasticsearch/83096)
**Author:** [@ibrahimsharaf](https://discuss.elastic.co/u/ibrahimsharaf)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 1:09pm UTC](https://discuss.elastic.co/t/how-to-change-log-files-indexing-between-logstash-and-elasticsearch/83096 "2017-04-21T13:09:50Z")
Hi there, I have many log files for scraped web-pages for online shopping stores, I ingest and process them using logstash, but every log file takes an elasticsearch index alone, I think this is not very efficient and no… --- ## [Logstashing windows event log](https://discuss.elastic.co/t/logstashing-windows-event-log/82705)
**Author:** [@rayback](https://discuss.elastic.co/u/rayback)\ **Replies:** 2\ **Last updated:** [April 19, 2017, 1:35pm UTC](https://discuss.elastic.co/t/logstashing-windows-event-log/82705 "2017-04-19T13:35:50Z")
I have a, event\_data.AccessMask : 0x1 in kibana. i want the value 0x1 to be stashed in a condition. however the field has a dot, (".") which I believe is frustrating me from getting the output that I need. I t… --- ## [Does the input and output plugins support variables?](https://discuss.elastic.co/t/does-the-input-and-output-plugins-support-variables/83160)
**Author:** [@Kvin](https://discuss.elastic.co/u/Kvin)\ **Replies:** 2\ **Last updated:** [April 21, 2017, 11:29am UTC](https://discuss.elastic.co/t/does-the-input-and-output-plugins-support-variables/83160 "2017-04-21T11:29:42Z")
I'm trying to set up a pipeline configuration with the following input filter: rabbitmq { exchange =\> "exchange" host =\> "%{HOST}" queue =\> "queue" durable =\> true ack =\> true threads =\> 1 prefetch\_count =\> 1000… --- ## [Logstash file input not working](https://discuss.elastic.co/t/logstash-file-input-not-working/82843)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 7\ **Last updated:** [April 21, 2017, 10:17am UTC](https://discuss.elastic.co/t/logstash-file-input-not-working/82843 "2017-04-21T10:17:03Z")
Hello, I have a question. Before i used filebeat to send logs to logstash. I decided (to better performance) to delete filebeat. Now i use file input in logstash : file { path =\> "/home/cra\_elk/\*" type =\> … --- ## [Cannot get indexes made by logstash](https://discuss.elastic.co/t/cannot-get-indexes-made-by-logstash/83163)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 9\ **Last updated:** [April 21, 2017, 10:11am UTC](https://discuss.elastic.co/t/cannot-get-indexes-made-by-logstash/83163 "2017-04-21T10:11:12Z")
I think my logstash is not working, Here is the configuration of logstash, input { file { type =\> nginx path =\> "/var/log/nginx/kibana\_access.log" } } output { elasticsearch { hosts =\> \["localh… --- ## [How to Shutdown logstash once it read full file](https://discuss.elastic.co/t/how-to-shutdown-logstash-once-it-read-full-file/83166)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 9:36am UTC](https://discuss.elastic.co/t/how-to-shutdown-logstash-once-it-read-full-file/83166 "2017-04-21T09:36:11Z")
logstash continuously reading file after reading full data from my CSV. I want to shutdown my logstash once it read full file and want to run another logstash. How can i stop logstash automatically once it read full … --- ## [Logstash Question](https://discuss.elastic.co/t/logstash-question/83178)
**Author:** [@Daniel69](https://discuss.elastic.co/u/Daniel69)\ **Replies:** 2\ **Last updated:** [April 21, 2017, 9:02am UTC](https://discuss.elastic.co/t/logstash-question/83178 "2017-04-21T09:02:43Z")
Hi, i have a question about logstash: I'm duplicating a value to easily parse it into an array like this: mutate { add\_field =\> \["\[@metadata\]\[MESSAGE\_DB\]", "%{MESSAGE}"\] } and then i can parse an array number lik… --- ## [Using Logstash as a Build Trigger (output exec?)](https://discuss.elastic.co/t/using-logstash-as-a-build-trigger-output-exec/83107)
**Author:** [@oddranger](https://discuss.elastic.co/u/oddranger)\ **Replies:** 4\ **Last updated:** [April 21, 2017, 9:09am UTC](https://discuss.elastic.co/t/using-logstash-as-a-build-trigger-output-exec/83107 "2017-04-21T09:09:12Z")
Hi everyone, I'm trying to use Logstash to trigger a simple script when receiving a certain type of log. After reading the documentation I presumed something like: output{ exec { command =\> "myscript" } } would… --- ## [After installing logstash-filter-jdbc\_streaming,im facing the follwing error when i check logstash configtest](https://discuss.elastic.co/t/after-installing-logstash-filter-jdbc-streaming-im-facing-the-follwing-error-when-i-check-logstash-configtest/83020)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 10\ **Last updated:** [April 21, 2017, 8:40am UTC](https://discuss.elastic.co/t/after-installing-logstash-filter-jdbc-streaming-im-facing-the-follwing-error-when-i-check-logstash-configtest/83020 "2017-04-21T08:40:15Z")
jones@logserver:~$ sudo service logstash configtest Bundler::GemNotFound: Could not find gem 'logstash-filter-jdbc\_streaming (\>= 0) java' in any of the gem sources listed in your Gemfile or installed on this machine. v… --- ## [Logstash Peformance](https://discuss.elastic.co/t/logstash-peformance/80966)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 34\ **Last updated:** [April 21, 2017, 8:37am UTC](https://discuss.elastic.co/t/logstash-peformance/80966 "2017-04-21T08:37:25Z")
Hello, I would like know tips to increase performance of Logtash. Currently i have : OS RH 7.1 : 12 CPU & 24 Go RAM Filebeat as shipper Elasticsearch : Xms Xmx : 12g Logstash (define in logstash.yml) : Work… --- ## [Logstash-input-jms problem reading messages from IBM WebSphere MQ (missing valuefier)](https://discuss.elastic.co/t/logstash-input-jms-problem-reading-messages-from-ibm-websphere-mq-missing-valuefier/81993)
**Author:** [@alexander-milovidov](https://discuss.elastic.co/u/alexander-milovidov)\ **Replies:** 2\ **Last updated:** [April 21, 2017, 8:24am UTC](https://discuss.elastic.co/t/logstash-input-jms-problem-reading-messages-from-ibm-websphere-mq-missing-valuefier/81993 "2017-04-21T08:24:00Z")
I have problem getting messages from IBM WebSphere MQ. It seems that some field(s) in MQMD header has type which is not handled properly. Some messages are read without exception. When I turn off include\_header setting i… --- ## [How can I deny the log message sent by unknown source? Thanks](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153)
**Author:** [@leftstar\_200](https://discuss.elastic.co/u/leftstar_200)\ **Replies:** 2\ **Last updated:** [April 21, 2017, 8:05am UTC](https://discuss.elastic.co/t/how-can-i-deny-the-log-message-sent-by-unknown-source-thanks/83153 "2017-04-21T08:05:38Z")
Hello all, I am receiving the Syslog using Logstash as Syslog server. My client machine sends the massage to Logstash server. My question is how can I specify which one or more client machines are valid to avoid dis… --- ## [Multiple CSV files, Multiple Header data](https://discuss.elastic.co/t/multiple-csv-files-multiple-header-data/83150)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 3\ **Last updated:** [April 21, 2017, 7:30am UTC](https://discuss.elastic.co/t/multiple-csv-files-multiple-header-data/83150 "2017-04-21T07:30:55Z")
Hi, I am using multiple csv input files with locations /user/location2/consumption-\*.csv /user/location2/maps\*.csv Now in my logstash configuration i want to use conditional basis the path of csv files input { … --- ## [How to split a field which would be no value set](https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155)
**Author:** [@kibanaLuee](https://discuss.elastic.co/u/kibanaLuee)\ **Replies:** 0\ **Last updated:** [April 21, 2017, 7:02am UTC](https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155 "2017-04-21T07:02:09Z")
I have a json log, format is: { "data": \[ { "Name": "a1 name", "Age": "a1 age", "School": \[ { "s1": "s1-value1", "s2": "s2-value1" … --- ## [Couldn't find any output plugin named 'elasticsearch'......error: manticore -- java.lang.NoSuchFieldError: INSTANCE](https://discuss.elastic.co/t/couldnt-find-any-output-plugin-named-elasticsearch-error-manticore-java-lang-nosuchfielderror-instance/82273)
**Author:** [@Daram\_Aparna](https://discuss.elastic.co/u/Daram_Aparna)\ **Replies:** 1\ **Last updated:** [April 21, 2017, 6:38am UTC](https://discuss.elastic.co/t/couldnt-find-any-output-plugin-named-elasticsearch-error-manticore-java-lang-nosuchfielderror-instance/82273 "2017-04-21T06:38:17Z")
Hi, I'm trying to use Elasticsearch as output in my configuration file. logstash version 2.1.0 elasticsearch version 2.3.2 But getting the below error: Couldn't find any output plugin named 'elasticsearch'. Are you… --- ## [Logstash is not reading data](https://discuss.elastic.co/t/logstash-is-not-reading-data/82262)
**Author:** [@udaykirankona](https://discuss.elastic.co/u/udaykirankona)\ **Replies:** 1\ **Last updated:** [April 21, 2017, 6:36am UTC](https://discuss.elastic.co/t/logstash-is-not-reading-data/82262 "2017-04-21T06:36:08Z")
HI, I installed ELK 5.3 version. When I start logstash to read the file for first time/even fresh file its not reading the data. If I un-comment start\_position, then Logstash reading data. otherwise its not... The … --- ## [Filebeat Elastic working, but filebeat logstash not working](https://discuss.elastic.co/t/filebeat-elastic-working-but-filebeat-logstash-not-working/83121)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 5\ **Last updated:** [April 21, 2017, 6:14am UTC](https://discuss.elastic.co/t/filebeat-elastic-working-but-filebeat-logstash-not-working/83121 "2017-04-21T06:14:44Z")
Hi, I am searching for a solution to this for past 2 days, but have not found it. Filebeat can send data to elasticsearch, but it is not working if I am sending it by logstash. Here is the filebeat.yml file, filebe… --- ## [Import CSV File as input in logstash and the output data to elasticsearch](https://discuss.elastic.co/t/import-csv-file-as-input-in-logstash-and-the-output-data-to-elasticsearch/82873)
**Author:** [@zegdene](https://discuss.elastic.co/u/zegdene)\ **Replies:** 9\ **Last updated:** [April 21, 2017, 5:21am UTC](https://discuss.elastic.co/t/import-csv-file-as-input-in-logstash-and-the-output-data-to-elasticsearch/82873 "2017-04-21T05:21:45Z")
Hi, I'm new in elasticsearch, i install elasticsearch, logstash and kibana, i need to import a CSV file as input in logstash and pass the outuput data to elasticsearch, I create the index in elasticsearch , in kibana i… --- ## [Sheduling logstash to run daily](https://discuss.elastic.co/t/sheduling-logstash-to-run-daily/83025)
**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\ **Replies:** 4\ **Last updated:** [April 21, 2017, 3:16am UTC](https://discuss.elastic.co/t/sheduling-logstash-to-run-daily/83025 "2017-04-21T03:16:17Z")
I'm planning to implement a java based REST service which will run logstash on a daily basis on my log files. How can I achieve that? --- ## [Logstash memory sizing](https://discuss.elastic.co/t/logstash-memory-sizing/82600)
**Author:** [@jasonkeller](https://discuss.elastic.co/u/jasonkeller)\ **Replies:** 3\ **Last updated:** [April 20, 2017, 11:37pm UTC](https://discuss.elastic.co/t/logstash-memory-sizing/82600 "2017-04-20T23:37:58Z")
I have a setup where I'll be receiving tons of netflow traffic (i.e. we have multiple 10gbit devices that will be forwarding netflow traffic from many tens of thousands of end users). Needless to say this will be brutal… --- ## [Closer than Before ... WoW .. Cisco Log Processing](https://discuss.elastic.co/t/closer-than-before-wow-cisco-log-processing/81726)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 9\ **Last updated:** [April 20, 2017, 9:43pm UTC](https://discuss.elastic.co/t/closer-than-before-wow-cisco-log-processing/81726 "2017-04-20T21:43:17Z")
I got this on my logstash.stdout but still No result found on Kibana ... Please anyone with a hint what still i miss i would really appreciate. Thanks in advance. "message" =\> "\<183\>Apr 10 2017 09:41:01 ha-fw1 : %… --- ## [How to extract XML attributes using XPath for Logstash](https://discuss.elastic.co/t/how-to-extract-xml-attributes-using-xpath-for-logstash/83105)
**Author:** [@ItsMeSurajR](https://discuss.elastic.co/u/ItsMeSurajR)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 9:04pm UTC](https://discuss.elastic.co/t/how-to-extract-xml-attributes-using-xpath-for-logstash/83105 "2017-04-20T21:04:18Z")
I'm trying to parse below XML to get all classname, name,failure and error message. But I'm unable to extract the individual xml elements using the xpath. Can someone point me where am I going wrong? here is my configu… --- ## [Filebeat published event but ElasticSearch doesn't show all those](https://discuss.elastic.co/t/filebeat-published-event-but-elasticsearch-doesnt-show-all-those/83097)
**Author:** [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Replies:** 0\ **Last updated:** [April 20, 2017, 5:35pm UTC](https://discuss.elastic.co/t/filebeat-published-event-but-elasticsearch-doesnt-show-all-those/83097 "2017-04-20T17:35:17Z")
Hi, I have multi line file beat (5.2) that sends entire xml as 1 event, this works as i can see the number of events published from filebeat are same as the number of files in the file beat path. I am pushing these e… --- ## [Not getting dynamic index in elasticsearch using logstash](https://discuss.elastic.co/t/not-getting-dynamic-index-in-elasticsearch-using-logstash/82514)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 8\ **Last updated:** [April 20, 2017, 4:01pm UTC](https://discuss.elastic.co/t/not-getting-dynamic-index-in-elasticsearch-using-logstash/82514 "2017-04-20T16:01:19Z")
Hello, I am facing issues when trying to create dynamic indexes using logstash. I have different log events coming from a single file,so i wanted to make them identifiable in the filter section using the identifier pres… --- ## [Date Filter Not working parsing IIS logs](https://discuss.elastic.co/t/date-filter-not-working-parsing-iis-logs/83071)
**Author:** [@Peter\_Dwyer](https://discuss.elastic.co/u/Peter_Dwyer)\ **Replies:** 6\ **Last updated:** [April 20, 2017, 3:19pm UTC](https://discuss.elastic.co/t/date-filter-not-working-parsing-iis-logs/83071 "2017-04-20T15:19:36Z")
I'm having trouble with the date filter. it doesn't seem to be updating the timestamp correctly. filter { if \[type\] == "iis" { grok { match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_timestamp} %{WORD:servic… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=995) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=997)