# Line sequence with logstash

**URL:** <https://discuss.elastic.co/t/line-sequence-with-logstash/234922>\
**Category:** Logstash\
**Created:** [May 29, 2020, 1:11pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922 "2020-05-29T13:11:26Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Katia](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@Katia](https://discuss.elastic.co/u/Katia)\
**Post date:** [May 29, 2020, 1:11pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/1 "2020-05-29T13:11:26Z")

</div>

Good morning,  
Can I get some help !  
I have a log file, where the first data on each line is in timestamp format.  
to do my analysis I need to know the order of these lines, so I used a new "seq" field with the ruby filter, as follows:

```auto
filter {
	ruby {
		path => "path/seq.rb"
	}	
}

```

my seq.rb is :

```auto
# encoding: binary

def register(params)
    @seq = 0
end

def filter(event)
    event.set("seq", @seq)
    @seq += 1
    return [event]
end

```

but my résult in kibana is :

```auto
 timestamp:20191101 00:00:00.390 seq = 5
 timestamp:20191101 00:00:00.500 seq = 1

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2020, 1:26pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/2 "2020-05-29T13:26:04Z")

</div>

Set pipeline.workers to 1 and you may also need to [disable java\_execution](https://github.com/elastic/logstash/issues/10938) until you get to 7.7.

---

<div class="post-metadata">

**Author:** ![Katia](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@Katia](https://discuss.elastic.co/u/Katia)\
**Post date:** [May 29, 2020, 1:44pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/3 "2020-05-29T13:44:06Z")

</div>

I modified logstash.yml and I put pipeline.workers to 1.  
But I don't know how to disable java execution, Is it like that?

```auto
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/gest.conf --java-execution false

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/4 "2020-05-29T13:47:08Z")

</div>

Yes, you can do it on the command line, or else do it in logstash.yml

---

<div class="post-metadata">

**Author:** ![Katia](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@Katia](https://discuss.elastic.co/u/Katia)\
**Post date:** [May 29, 2020, 2:01pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/5 "2020-05-29T14:01:29Z")

</div>

I have 7.7, and I get this when I run logstash :

```auto
[INFO] 2020-05-29 15:57:43.657 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.7.0"}

```

I still need to make the changes?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2020, 2:02pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/6 "2020-05-29T14:02:31Z")

</div>

You will need pipeline.workers 1 but will probably be OK without disabling java\_execution.

---

<div class="post-metadata">

**Author:** ![Katia](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@Katia](https://discuss.elastic.co/u/Katia)\
**Post date:** [May 29, 2020, 2:09pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/7 "2020-05-29T14:09:04Z")

</div>

I've had workers =1 since the beginning but I still have the problem of these lines in disorder.  
Can the encoding line at the beginning of my seq.rb file cause this problem?

---

<div class="post-metadata">

**Author:** ![Katia](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@Katia](https://discuss.elastic.co/u/Katia)\
**Post date:** [May 29, 2020, 2:37pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/8 "2020-05-29T14:37:19Z")

</div>

I think it works now with -w 1:

```auto
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/gest.conf -w 1 --java-execution=false 

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2020, 2:37pm UTC](https://discuss.elastic.co/t/line-sequence-with-logstash/234922/9 "2020-06-26T14:37:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.