# Logstash influxdb issues **URL:** \ **Category:** Logstash\ **Created:** [March 16, 2017, 1:30am UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782 "2017-03-16T01:30:24Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![V\_Kurien](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@V\_Kurien](https://discuss.elastic.co/u/V_Kurien)\ **Post date:** [March 16, 2017, 1:30am UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/1 "2017-03-16T01:30:25Z")
# Hi all I'm having some issues with using the influxdb plugin for logstash. Here is the config that I am using: input { file { path =\> "/var/log/flowlog/flowlog.log" type =\> "conntrack-flowlog" start\_position =\> "beginning" } } filter { if [type] == "conntrack-flowlog" { grok { patterns\_dir =\> ["./patterns"] match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{DATA:logger\_program} %{DATA:logger\_prefix} %{DATA} %{DATA} SRC=%{IPV4:src\_ip} DST=%{IPV4:dst\_ip } PROTO=%{WORD:proto} SPT=%{INT:src\_port} DPT=%{INT:dest\_port} PKTS=%{INT:spkts} BYTES=%{INT:sent\_bytes} %{MATCH\_TO\_SRC:cruft}%{MATCH\_TO\_BYTE:more\_cruft}BYTES =%{INT:recv\_bytes}" } } } } output { influxdb { host =\> "xxx" db =\> "flowlog" measurement =\> "tcp\_flows" send\_as\_tags =\> ["src\_ip", "dst\_port"] data\_points =\> {'src\_ip' =\> [src\_ip],'dst\_ip' =\> [dst\_ip],'ip\_proto' =\> [proto],'src\_port' =\> [src\_port],'dst\_port' =\> [dst\_port],'sent\_bytes' =\> [ sent\_bytes],'recv\_bytes' =\> [recv\_bytes] } # data\_points =\> {} ``` flush_size => 10 } ``` } # output { # stdout{ codec=\>rubydebug } # } # == Everything works fine when I use the stdout output. However there seems to be some issue with the data\_points field - config test tells me: # logstash -f . -v --configtest Error: Expected one of #, } at line 26, column 48 (byte 815) after output { influxdb { host =\> "xxx" db =\> "flowlog" measurement =\> "tcp\_flows" send\_as\_tags =\> ["src\_ip", "dst\_port"] data\_points =\> {'src\_ip' =\> [src\_ip] Any idea as to what is going wrong here? The documentation seems to indicate that I should pass a hash but it is not clear what hash to pass exactly. ---
**Author:** ![azeiner](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Post date:** [March 16, 2017, 4:17pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/2 "2017-03-16T16:17:09Z")
i've got the same problems, i solved it by using such a config style ``` influxdb { db => "toast" host => "localhost" measurement => "myseries" allow_time_override => true use_event_fields_for_data_points => true exclude_fields => ["@version", "@timestamp", "sequence", "message", "type", "host"] send_as_tags => ["bar", "feild", "test1", "test"] } ``` although i've a problem that my fields from redis are all strings, not integer or float! ---
**Author:** ![V\_Kurien](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@V\_Kurien](https://discuss.elastic.co/u/V_Kurien)\ **Post date:** [March 16, 2017, 5:46pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/4 "2017-03-16T17:46:15Z")
Hi Andreas I solved the original problem by using a style for datapoints like: # == {'src\_ip' =\> "%{src\_ip}" 'dst\_ip' =\> "%{dst\_ip}" 'ip\_proto' =\> "%{proto}" 'src\_port' =\> "%{src\_port}" 'dest\_port' =\> "%{dest\_port}" 'sent\_bytes' =\> "%{sent\_bytes}" 'recv\_bytes' =\> "%{recv\_bytes}" } Why the documentation is so completely wrong is beyond me. Furthermore I had to set the retention policy to autogen (not default) since there is no policy called default in recent influxdbs. What should have taken 1/2 an hour landed up taking way way more. @Logstash folks: Want me to file a doc PR? ---
**Author:** ![azeiner](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Post date:** [March 16, 2017, 6:24pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/5 "2017-03-16T18:24:36Z")
hi thanks for posting, i get an error when using this style, but will try it again tomorrow! i also hat to set the retention policy to autogen ... so ... maybe we could exchange some knowledge about this issues because it seems not many are using this type of logstash connection? as an input i use redis and this is completly confusing what is happening because i've this redis list e.g foo=10207 bar=1 sensor2=1 sensor3=33.3 time=1489686662 foo=10207 bar=1 sensor2=1 sensor3=33.3 time=1489686662 foo=10207 bar=1 sensor2=1 sensor3=33.3 time=1489686662 foo=10207 bar=1 sensor2=1 sensor3=33.3 time=1489686662 but every field is created as string inside influxdb - no chance of predefining a schema as in elasticsearch or so ... ---
**Author:** ![azeiner](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Post date:** [March 17, 2017, 9:30am UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/6 "2017-03-17T09:30:52Z")
hey, when i try to use this form output { ``` stdout { codec => rubydebug } influxdb { db => "toast" host => "localhost" measurement => "myseries" allow_time_override => true exclude_fields => ["@version", "@timestamp", "sequence", "message", "type", "host"] send_as_tags => ["bar", "feild", "test1", "test"] data_points => {'foo' => "%{foo}",'sensor2' => "%{sensor2_ip}",'sensor3' => "%{sensor3}"} } } ``` i get an error. how did you solve this problem, could you post your connection logstash file please? this would really help a lot!! JAVA\_OPTS was set to [ -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:+CMSP arallelRemarkEnabled -XX:SurvivorRatio=8 -XX:MaxTenuringThreshold=1 -XX:CMSIniti atingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutO fMemoryError -XX:HeapDumpPath="C:\tools\logstash-5.2.2/heapdump.hprof"]. Logstas h will trust these options, and not set any defaults that it might usually set Could not find log4j2 configuration at path /tools/logstash-5.2.2/config/log4j2. properties. Using default config which logs to console 10:31:41.517 [LogStash::Runner] ERROR logstash.agent - Cannot load an invalid co nfiguration {:reason=\>"Expected one of #, {, } at line 37, column 37 (byte 731) after output {\n\n\tstdout { codec =\> rubydebug }\n\n influxdb {\n\t\t db =\> "toast"\n host =\> "localhost"\n measureme nt =\> "myseries"\n allow\_time\_override =\> true\n \n exclude\_fields =\> ["@version", "@timestamp", "sequence", "message", "type", "host"]\n\t\t\tsend\_as\_tags =\> ["bar", "feild", "test1", "te st"]\n\t\t\tdata\_points =\> {'foo' =\> "%{foo}""} ---
**Author:** ![azeiner](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Post date:** [March 17, 2017, 9:34am UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/7 "2017-03-17T09:34:48Z")
got it, removed the "," between the fieldpoints!! ---
**Author:** ![V\_Kurien](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@V\_Kurien](https://discuss.elastic.co/u/V_Kurien)\ **Post date:** [March 17, 2017, 4:02pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/8 "2017-03-17T16:02:19Z")
It is rather idiotic. The documentation says that you need , between fields, but of course it ain't so. And if you don't quote the datapoint fields "%{foo}" it also barfs. Oh, joy!! ---
**Author:** ![azeiner](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Post date:** [March 17, 2017, 4:26pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/9 "2017-03-17T16:26:53Z")
you are so right, i tried for hours to get the right syntax ... here is my config file for transferring redis to influx via logstash ... works as i can say, except i get other errors now but one step after the other! thanks a lot mate! input { ``` redis{ host => "localhost" data_type => "list" key => "vortex" threads => 4 type => "testrecord" codec => "plain" } } ``` filter { kv {} mutate { ``` convert => { "foo" => "integer" "sensor2" => "float" "sensor3" => "float" } ``` } } output { ``` stdout { codec => rubydebug } influxdb { db => "gronk" host => "localhost" measurement => "wonk" allow_time_override => true use_event_fields_for_data_points => true exclude_fields => ["@version", "@timestamp", "sequence", "message", "type", "host"] send_as_tags => ["bar", "feild", "test1", "test"] } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2017, 4:26pm UTC](https://discuss.elastic.co/t/logstash-influxdb-issues/78782/10 "2017-04-14T16:26:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.