# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=999 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1000 --- ## [Logstash 5.3 bad uri error](https://discuss.elastic.co/t/logstash-5-3-bad-uri-error/82504)
**Author:** [@brechtDhondt](https://discuss.elastic.co/u/brechtDhondt)\ **Replies:** 1\ **Last updated:** [April 17, 2017, 4:24am UTC](https://discuss.elastic.co/t/logstash-5-3-bad-uri-error/82504 "2017-04-17T04:24:20Z")
I'm trying out logstash 5.3.0 and just running a test.conf isn't working. below is the error i get. i saw before that there might be errors if i extract logstash to a path with a space so it is located in "c:/developer/e… --- ## [Timestamp problem - SOLVED](https://discuss.elastic.co/t/timestamp-problem-solved/82519)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 3\ **Last updated:** [April 17, 2017, 3:46am UTC](https://discuss.elastic.co/t/timestamp-problem-solved/82519 "2017-04-17T03:46:19Z")
Dear Logstash Users, Sorry, i've seen many threads but they didn't seem to solve my problem. Specifically: 1) Using Logstash 5.3.0 / ES hosted 5.3.0 2) Logstash is running locally on my machine (Mac : maybe this is … --- ## [Logstash using 100% of one CPU core](https://discuss.elastic.co/t/logstash-using-100-of-one-cpu-core/44200)
**Author:** [@ruda\_porto](https://discuss.elastic.co/u/ruda_porto)\ **Replies:** 4\ **Last updated:** [April 16, 2017, 6:49am UTC](https://discuss.elastic.co/t/logstash-using-100-of-one-cpu-core/44200 "2017-04-16T06:49:46Z")
Hi, I'm using Logstash to parse two log files and use multiline filter of then. I experienced high CPU usage (100% of one CPU core) but on my log a have only this message: tail -n40 -f /var/log/logstash/logstash.log … --- ## [Perform action when logstash is complete](https://discuss.elastic.co/t/perform-action-when-logstash-is-complete/82127)
**Author:** [@vinodMS](https://discuss.elastic.co/u/vinodMS)\ **Replies:** 1\ **Last updated:** [April 16, 2017, 6:36pm UTC](https://discuss.elastic.co/t/perform-action-when-logstash-is-complete/82127 "2017-04-16T18:36:00Z")
I'm currently using logstash to pipe data from MySQL and then index this data to elasticsearch. I have python scripts that creates dynamic logstash configurations and creates subprocesses to run it. But since logstas… --- ## [If Response code is other than 200 repeat output](https://discuss.elastic.co/t/if-response-code-is-other-than-200-repeat-output/82502)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 0\ **Last updated:** [April 16, 2017, 2:15pm UTC](https://discuss.elastic.co/t/if-response-code-is-other-than-200-repeat-output/82502 "2017-04-16T14:15:41Z")
Hi All I am using http output plugin, i get response either 200 ( Success) and 531 (Failure) 531: Failure is because of network traffic I want 531 which is failure, the output plugin should retry to insert the reco… --- ## [Asa-5-304001](https://discuss.elastic.co/t/asa-5-304001/82394)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 3\ **Last updated:** [April 16, 2017, 8:21am UTC](https://discuss.elastic.co/t/asa-5-304001/82394 "2017-04-16T08:21:29Z")
Anyone with working pattern for this message "message" =\> "\<181\>Apr 14 2017 23:00:41 ha-fw1 : %ASA-5-304001: src\_ip Accessed URL 216.58.203.109:http://accounts.google.com/\\n", thanks in advance .... --- ## [Logstash sending it's metric data to elasticsearch in localhost instead of configured host](https://discuss.elastic.co/t/logstash-sending-its-metric-data-to-elasticsearch-in-localhost-instead-of-configured-host/82232)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 1\ **Last updated:** [April 16, 2017, 12:33am UTC](https://discuss.elastic.co/t/logstash-sending-its-metric-data-to-elasticsearch-in-localhost-instead-of-configured-host/82232 "2017-04-16T00:33:59Z")
Hello I am trying to configure x-pack monitoring for logstash but not working as expected. As a test , I am using user elastic instead of logstashwriter\_ as written in the doc. I see below error log in logstash-pl… --- ## [Calculate time difference between two logs with unique ID](https://discuss.elastic.co/t/calculate-time-difference-between-two-logs-with-unique-id/82333)
**Author:** [@michaeleino](https://discuss.elastic.co/u/michaeleino)\ **Replies:** 1\ **Last updated:** [April 16, 2017, 12:30am UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-logs-with-unique-id/82333 "2017-04-16T00:30:31Z")
hello all, I'm in the need to calculate the time difference manually without the elapsed plug-in as my end time varies & may got to 24hour with a very big amount of logs. I managed to get the start time from the old log … --- ## [How to maintain the order of logs](https://discuss.elastic.co/t/how-to-maintain-the-order-of-logs/53397)
**Author:** [@mattgolding](https://discuss.elastic.co/u/mattgolding)\ **Replies:** 8\ **Last updated:** [April 15, 2017, 6:36pm UTC](https://discuss.elastic.co/t/how-to-maintain-the-order-of-logs/53397 "2017-04-15T18:36:20Z")
Hi I have a script which is bringing in log files and I am pushing them into Elasticsearch via Logstash and it all appears fine. However when searching over these logs I am finding it difficult to keep them in the order… --- ## [Http output retryable\_codes not working](https://discuss.elastic.co/t/http-output-retryable-codes-not-working/82251)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 2\ **Last updated:** [April 15, 2017, 4:35pm UTC](https://discuss.elastic.co/t/http-output-retryable-codes-not-working/82251 "2017-04-15T16:35:16Z")
http output retryable\_codes not working In my http output, i am applying this to retry the POST retryable\_codes =\> \[531\] i get this below error message ERROR logstash.outputs.http - Unknown setting 'r etryable\_code… --- ## [Some logstash feature requests](https://discuss.elastic.co/t/some-logstash-feature-requests/82471)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 4\ **Last updated:** [April 15, 2017, 1:44pm UTC](https://discuss.elastic.co/t/some-logstash-feature-requests/82471 "2017-04-15T13:44:19Z")
Dear Logstash Team, I've grown to love Elastic Stack and we're now adopting and seeing the power of it. I'd love to see the following features: For Record Last Run & Meta Data Path. This is a great way of tracking yo… --- ## [Parse Java logs](https://discuss.elastic.co/t/parse-java-logs/82469)
**Author:** [@ItsMeSurajR](https://discuss.elastic.co/u/ItsMeSurajR)\ **Replies:** 1\ **Last updated:** [April 15, 2017, 1:00pm UTC](https://discuss.elastic.co/t/parse-java-logs/82469 "2017-04-15T13:00:48Z")
Hello all, I'm new to this framework. I'm trying to parse java log files (which is not in JSON) lookin for errors in the build. Trying to add statistics for the kind of failure over time. Is this possible to achieve? … --- ## [Pattern works in grok debug but not in logstash](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305)
**Author:** [@krazyjakee](https://discuss.elastic.co/u/krazyjakee)\ **Replies:** 1\ **Last updated:** [April 15, 2017, 11:50am UTC](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305 "2017-04-15T11:50:34Z")
Example log: 2017-04-05T08:08:06.876675+00:00 app\[web.1\]: Read fragment views/people/113477-20160223215243633000/meta/cf52ea03049257538d100aca49e4c24 (1.6ms) 2017-04-05T08:08:06.847774+00:00 app\[web.1\]: Parameters: {… --- ## [How to use Logstash with a Let's Encrypt certificate?](https://discuss.elastic.co/t/how-to-use-logstash-with-a-lets-encrypt-certificate/82463)
**Author:** [@MarathonStudios](https://discuss.elastic.co/u/MarathonStudios)\ **Replies:** 0\ **Last updated:** [April 15, 2017, 4:13am UTC](https://discuss.elastic.co/t/how-to-use-logstash-with-a-lets-encrypt-certificate/82463 "2017-04-15T04:13:52Z")
When I tried to set up Logstash without TLS, I kept receiving an infuriating "connection reset by peer error, no matter what options I used, and absolutely nothing on this forum was useful in solving it. I'm now trying… --- ## [Cannot serialize instance of: Sequel::SQL::Blob](https://discuss.elastic.co/t/cannot-serialize-instance-of-sequel-sql-blob/55911)
**Author:** [@bizkit](https://discuss.elastic.co/u/bizkit)\ **Replies:** 7\ **Last updated:** [April 14, 2017, 10:13pm UTC](https://discuss.elastic.co/t/cannot-serialize-instance-of-sequel-sql-blob/55911 "2017-04-14T22:13:24Z")
LogStash::Json::GeneratorError: Cannot serialize instance of: Sequel::SQL::Blob The above error is received our new logstash instance. logstash-2.3 Installed Packages logstash.noarch … --- ## [Unable to get Logstash to read from kafka input](https://discuss.elastic.co/t/unable-to-get-logstash-to-read-from-kafka-input/82090)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 3\ **Last updated:** [April 14, 2017, 4:11pm UTC](https://discuss.elastic.co/t/unable-to-get-logstash-to-read-from-kafka-input/82090 "2017-04-14T16:11:17Z")
In my setup I have Filebeats -\> Kafka -\> Logstash -\> ElasticSearch. I can see filebeats producing logs into Kakfa-topic and I am also able to read logs from kafka topic using kafka-consumer-client. But I do not see l… --- ## [Logstash-jdbc-input Oracle SQL issue](https://discuss.elastic.co/t/logstash-jdbc-input-oracle-sql-issue/82219)
**Author:** [@s58smith](https://discuss.elastic.co/u/s58smith)\ **Replies:** 4\ **Last updated:** [April 14, 2017, 4:04pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-oracle-sql-issue/82219 "2017-04-14T16:04:27Z")
I'm having trouble trying to figure out why my SQL statement is not working. I've tested enough combinations that I have it narrowed down to a single line causing issue. "AND collection\_system\_date \>= SYSDATE - 300/86400… --- ## [Lost connection when adding filter files and patterns in logstash](https://discuss.elastic.co/t/lost-connection-when-adding-filter-files-and-patterns-in-logstash/81654)
**Author:** [@aziz\_007](https://discuss.elastic.co/u/aziz_007)\ **Replies:** 8\ **Last updated:** [April 14, 2017, 1:56pm UTC](https://discuss.elastic.co/t/lost-connection-when-adding-filter-files-and-patterns-in-logstash/81654 "2017-04-14T13:56:27Z")
i work with zimbra i have created a grok filter for mailbox.log and a pattern file i have put the filter file called zimbra\_mailbox.conf in /etc/logstash/conf.d/ and i have created a directory called patterns in /etc… --- ## [Cannot get my template to work](https://discuss.elastic.co/t/cannot-get-my-template-to-work/27150)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 16\ **Last updated:** [April 14, 2017, 1:26pm UTC](https://discuss.elastic.co/t/cannot-get-my-template-to-work/27150 "2017-04-14T13:26:27Z")
I am trying to do a simple test to get ES to use a template of relying on default mapping to make sure the correct mappings are applied for each data type and not analyze all fields. It does not seem to apply the templat… --- ## [\[SOLVED\] TCP "RST"/reset causing Filebeat/Logstash connection reset](https://discuss.elastic.co/t/solved-tcp-rst-reset-causing-filebeat-logstash-connection-reset/82343)
**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\ **Replies:** 2\ **Last updated:** [April 14, 2017, 11:42am UTC](https://discuss.elastic.co/t/solved-tcp-rst-reset-causing-filebeat-logstash-connection-reset/82343 "2017-04-14T11:42:59Z")
I have a RHEL 6 Linux server (10.230.143.160) running ELK 5.3 and a Windows client (10.230.143.31) with Filebeat shipping logs to the server. I’m seeing a very consistent issue where every few minutes the Filebeat log … --- ## [Logstash input tcp keepalive](https://discuss.elastic.co/t/logstash-input-tcp-keepalive/82375)
**Author:** [@qin](https://discuss.elastic.co/u/qin)\ **Replies:** 1\ **Last updated:** [April 14, 2017, 10:41am UTC](https://discuss.elastic.co/t/logstash-input-tcp-keepalive/82375 "2017-04-14T10:41:26Z")
I use the logstash TCP plugin, this is a server ; In the process of use, The client abnormal disconnected the connection, However the server didn't disconnect, So server TCP connections have been increased; I try to mod… --- ## [Configure Logstash output with InfluxDB](https://discuss.elastic.co/t/configure-logstash-output-with-influxdb/82402)
**Author:** [@yarik](https://discuss.elastic.co/u/yarik)\ **Replies:** 0\ **Last updated:** [April 14, 2017, 10:16am UTC](https://discuss.elastic.co/t/configure-logstash-output-with-influxdb/82402 "2017-04-14T10:16:50Z")
Hi I am trying to configure Logstash with InfluxDB by means of plugin. I Have a config file which perfectly works with ELK. Code snippet is given below: \> input{ file { path =\> "C:\\logstash-5.0.0\\logs\\nlog.lo… --- ## [Validation in logstash input section](https://discuss.elastic.co/t/validation-in-logstash-input-section/81815)
**Author:** [@kiranilla](https://discuss.elastic.co/u/kiranilla)\ **Replies:** 3\ **Last updated:** [April 14, 2017, 9:36am UTC](https://discuss.elastic.co/t/validation-in-logstash-input-section/81815 "2017-04-14T09:36:26Z")
I have tried by running the following script in the input section providing a wrong input file path but it did not show any error message after running the script: input { file { path =\> "C:\\DataSet\\EXP\_DATA.csv" … --- ## [Problem grok pattern](https://discuss.elastic.co/t/problem-grok-pattern/82200)
**Author:** [@Vittorio](https://discuss.elastic.co/u/Vittorio)\ **Replies:** 5\ **Last updated:** [April 14, 2017, 9:29am UTC](https://discuss.elastic.co/t/problem-grok-pattern/82200 "2017-04-14T09:29:28Z")
Hi all, I'm issuing a problem while using filter grok. For instance, i'm trying to parse nginx logs using this pattern: NGUSERNAME \[a-zA-Z\\.\\@\\-\\+\_%\]+ NGUSER %{NGUSERNAME} NGINXACCESS %{IPORHOST:clientip} %{NGUSER:id… --- ## [Grok Help](https://discuss.elastic.co/t/grok-help/50606)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 7\ **Last updated:** [April 14, 2017, 8:24am UTC](https://discuss.elastic.co/t/grok-help/50606 "2017-04-14T08:24:14Z")
Hi I'm new to ELK and Grok, so sorry if this seems to be basic, but I just can't seem to get this to work. Basically I am trying to get a few more Cisco ASA logs parsed (others are essentially being passed as per htt… --- ## [Silence json parse failures from Logstash logs?](https://discuss.elastic.co/t/silence-json-parse-failures-from-logstash-logs/82363)
**Author:** [@Ibrahim\_Awwal](https://discuss.elastic.co/u/Ibrahim_Awwal)\ **Replies:** 1\ **Last updated:** [April 14, 2017, 8:18am UTC](https://discuss.elastic.co/t/silence-json-parse-failures-from-logstash-logs/82363 "2017-04-14T08:18:10Z")
Hi! Simple question: is there any way to silence json parse failure events from showing up in logstash's logs? I'm fine with the default behavior of passing it through as plain text and adding the \_jsonparsefailure tag, … --- ## [Logstash yum repo certificate validity issue](https://discuss.elastic.co/t/logstash-yum-repo-certificate-validity-issue/82383)
**Author:** [@venkat2](https://discuss.elastic.co/u/venkat2)\ **Replies:** 0\ **Last updated:** [April 14, 2017, 6:58am UTC](https://discuss.elastic.co/t/logstash-yum-repo-certificate-validity-issue/82383 "2017-04-14T06:58:36Z")
I am trying to install logstash with yum, as per instructions I am trying to pull repo certificates with "rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch", however this command gives me curl: (60) Peer'… --- ## [Logstash stopped at the line pipeline main started](https://discuss.elastic.co/t/logstash-stopped-at-the-line-pipeline-main-started/81569)
**Author:** [@Daram\_Aparna](https://discuss.elastic.co/u/Daram_Aparna)\ **Replies:** 6\ **Last updated:** [April 14, 2017, 5:20am UTC](https://discuss.elastic.co/t/logstash-stopped-at-the-line-pipeline-main-started/81569 "2017-04-14T05:20:39Z")
Hi .. I'm new to ELK I'm trying to execute simple logstash (version: 2.3.2) command, but it has stopped working Command: D:\\downloads\\elk\\logstash\\bin\>logstash -e 'input { stdin { } } output { stdout { } }' --debug o… --- ## [I run the logstash , it will getting error](https://discuss.elastic.co/t/i-run-the-logstash-it-will-getting-error/82242)
**Author:** [@bvnages](https://discuss.elastic.co/u/bvnages)\ **Replies:** 4\ **Last updated:** [April 14, 2017, 4:33am UTC](https://discuss.elastic.co/t/i-run-the-logstash-it-will-getting-error/82242 "2017-04-14T04:33:22Z")
Sending Logstash's logs to /elk/logstash-5.2.0/logs which is now configured via log4j2.properties \[2017-04-13T04:45:15,744\]\[INFO \]\[logstash.setting.writabledirectory\] Creating directory {:setting=\>"path.queue", :path=\>"/… --- ## [Grok match everything up to certain character sequence?](https://discuss.elastic.co/t/grok-match-everything-up-to-certain-character-sequence/82268)
**Author:** [@jovanmal](https://discuss.elastic.co/u/jovanmal)\ **Replies:** 7\ **Last updated:** [April 14, 2017, 4:18am UTC](https://discuss.elastic.co/t/grok-match-everything-up-to-certain-character-sequence/82268 "2017-04-14T04:18:12Z")
Hi guys, does anybody know how to grok all text from log entry until certain character sequence? For example, how to seperate only SiteController::actionThankYou() Displaying random premium game. from the follow… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=998) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1000)