# Blank line in aws name

**URL:** <https://discuss.elastic.co/t/blank-line-in-aws-name/136516>\
**Category:** Logstash\
**Created:** [June 19, 2018, 2:57pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516 "2018-06-19T14:57:56Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yotam\_Hershkovitz](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@Yotam\_Hershkovitz](https://discuss.elastic.co/u/Yotam_Hershkovitz)\
**Post date:** [June 19, 2018, 2:57pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/1 "2018-06-19T14:57:56Z")

</div>

Hi,

I'm a bit new to all of this so I hope I'll be clear enough.

We're seeing in logstash a blank line as seen in the picture.  
Even when I export it in raw or formatted the blank line is there with the count.

What can be the issue?

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c87ea227fbb62329b357f6c3d732e62bac85fdc9.PNG)

Thanks

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [June 19, 2018, 3:16pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/2 "2018-06-19T15:16:09Z")

</div>

Hi @Yotam_Hershkovitz,

How are you getting your data into Elasticsearch? It seems like you have a number of documents with either a missing or empty `aws-name` field, and the missing/empty field is treated like any other entry when performing aggregations like this.

---

<div class="post-metadata">

**Author:** ![Yotam\_Hershkovitz](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@Yotam\_Hershkovitz](https://discuss.elastic.co/u/Yotam_Hershkovitz)\
**Post date:** [June 20, 2018, 9:43am UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/3 "2018-06-20T09:43:59Z")

</div>

From what I understand we have linux servers with logstash installed on them and they send the data (sorry if this is obvious) to the kibana server.  
I can't seem to figure out where does the aws server names comes from, I mean where does logstash gets the server names?  
it's not from the server itself since there's nowhere the hostname appears.

it there a conf file with the name somewhere?

any suggestions ?

Im sorry if what I wrote isn't correct / clear / or really obvious

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [June 20, 2018, 12:11pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/4 "2018-06-20T12:11:51Z")

</div>

Hi @Yotam_Hershkovitz, I've moved this to the Logstash forum, so they can help you with your Logstash configuration.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 20, 2018, 8:25pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/5 "2018-06-20T20:25:01Z")

</div>

> I can't seem to figure out where does the aws server names comes from, I mean where does logstash gets the server names?

That's entirely up to your Logstash configuration, so unless you show it to us we can't possibly help.

---

<div class="post-metadata">

**Author:** ![Yotam\_Hershkovitz](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@Yotam\_Hershkovitz](https://discuss.elastic.co/u/Yotam_Hershkovitz)\
**Post date:** [June 25, 2018, 12:41pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/8 "2018-06-25T12:41:12Z")

</div>

Here's the logstash config file: /etc/logstash/logstash.conf

```
   output {
    if "ERROR" in [level]
    {
      datadog {
        api_key => xxx_I_prefer_not_writing it here_xxxxxx"
        alert_type => "error"
        title => "Logstash event for ${HOSTNAME:NA}, Instance-Id: ${AWS_ID:NA}, Name-Tag: ${AWS_NAME:NA}"
      }
    }
    elasticsearch {
        hosts => ['IP1:PORT', 'IP2:PORT']
        index => 'logstash-%{+YYYY.MM.dd}'
    }
}

input {
  file {
    path => '/workspace/server-name-*/logs/*.log'
    type => 'erver-name'
    codec => multiline {
      pattern => '^%{TIMESTAMP_ISO8601} '
      negate => true
      what => previous
    }
  }
}

filter {
  mutate {
    remove_field => ["host", "aws-id", "host-ip", "aws-name"]
  }
  mutate {
    add_field => {
      "host" => "${HOSTNAME:NA}"
      "aws-id" => "${AWS_ID:NA}"
      "host-ip" => "${HOST_IP:NA}"
      "aws-name" => "${AWS_NAME:NA}"
    }
  }
  grok {
    match => { 'message' => '%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:level}%{SPACE}\[%{DATA:thread}]%{SPACE}%{USERNAME:file}~%{USERNAME:method}%{SPACE}%{GREEDYDATA:logmsg}' }
  }
  date {
    match => ['timestamp', 'yyyy-MM-dd HH:mm:ss,SSS']
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2018, 1:09pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/9 "2018-06-25T13:09:27Z")

</div>

According to your configuration the `aws-name` field comes from the AWS\_NAME environment variable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2018, 1:09pm UTC](https://discuss.elastic.co/t/blank-line-in-aws-name/136516/10 "2018-07-23T13:09:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.