# Logstash output influxdb problem

**URL:** <https://discuss.elastic.co/t/logstash-output-influxdb-problem/161509>\
**Category:** Logstash\
**Created:** [December 19, 2018, 12:18pm UTC](https://discuss.elastic.co/t/logstash-output-influxdb-problem/161509 "2018-12-19T12:18:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abu.sayeed](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\
**Post date:** [December 19, 2018, 12:18pm UTC](https://discuss.elastic.co/t/logstash-output-influxdb-problem/161509/1 "2018-12-19T12:18:22Z")

</div>

```
input {
beats {
port => 5044
ssl => true
type => "json"
ssl_certificate => "/etc/pki/tls/certs/abc.crt"
ssl_key => "/etc/pki/tls/private/abc.key"
}
}

filter {
if [type] == "wineventlog" {

ruby {
code => "
  event.get('event_data').each {|k, v|
    event.set(k, v)
  }
  event.remove('event_data')
"
}

mutate {
  rename => ["[host][name]", "hostname" ]
}
mutate {
   remove_field => ["tags", "opcode", "@version", "beat", "message", "LogonGuid", "ProcessId", "ProcessName", "SubjectLogonId", "SubjectUserSid", "TargetInfo", "TargetLogonGuid", "activity_id", "event_id", "opcode", "process_id", "provider_guid", "record_number", "param10", "param11", "param4", "param5", "param8", "thread_id", "param7", "LmPackageName", "IpPort", "ImpersonationLevel", "KeyLength", "TransmittedServices", "TargetLogonId", "TargetUserSid", "host"]
}
}
}

output {
influxdb {
host => ["192.168.100.1"]
port => 8086
user => "admin"
password => "admin"
db => "dac_demo"
measurement => "winevent_log"
allow_time_override => "true"
time_precision => "s"
use_event_fields_for_data_points => "true"
exclude_fields => ["message", "@timestamp", "@version", "sequence", "type", "ElevatedToken", "LogonProcessName", "TargetDomainName", "task", "TargetLinkedLogonId", "VirtualAccount", "PrivilegeList"]
send_as_tags => ["host", "source"]
data_points => { }
}
stdout {
codec => rubydebug
}
}

```

Error:

[2018-12-18T15:21:10,775][WARN][logstash.outputs.influxdb] Non recoverable exception while writing to InfluxDB {:exception=\>#\<InfluxDB::Error: {"error":"unable to parse 'winevent\_log computer\_name="[windows-user1.example.com](http://windows-user1.example.com)",source\_name="Microsoft-Windows-Security-Auditing",log\_name="Security",hostname="windows-user1",SubjectUserName="SYSTEM",keywords=["Audit Success"],level="Information",SubjectDomainName="NT AUTHORITY" 1545124867': invalid boolean\nunable to parse 'winevent\_log computer\_name="[windows-user1.example.com](http://windows-user1.example.com)",IpAddress="-",log\_name="Security",SubjectUserName="windows-user1$",level="Information",RestrictedAdminMode="-",TargetOutboundDomainName="-",AuthenticationPackageName="Negotiate",TargetUserName="SYSTEM",source\_name="Microsoft-Windows-Security-Auditing",hostname="windows-user1",keywords=["Audit Success"],SubjectDomainName="example",version=2i,WorkstationName="-",LogonType="5",TargetOutboundUserName="-" 1545124867': invalid boolean"}

Logstash fields like:

{  
"computer\_name" =\> "[windows-user1.example.com](http://windows-user1.example.com)",  
"IpAddress" =\> "-",  
"task" =\> "Logon",  
"log\_name" =\> "Security",  
"VirtualAccount" =\> "%%1843",  
"SubjectUserName" =\> "windows-user1.example$",  
"level" =\> "Information",  
"@timestamp" =\> 2018-12-18T09:02:16.033Z,  
"RestrictedAdminMode" =\> "-",  
"AuthenticationPackageName" =\> "Negotiate",  
"TargetOutboundDomainName" =\> "-",  
"TargetUserName" =\> "SYSTEM",  
"LogonProcessName" =\> "Advapi ",  
"type" =\> "wineventlog",  
"TargetLinkedLogonId" =\> "0x0",  
"source\_name" =\> "Microsoft-Windows-Security-Auditing",  
"TargetDomainName" =\> "NT AUTHORITY",  
"hostname" =\> "windows-user1.example",  
"keywords" =\> [  
[0] "Audit Success"  
],  
"ElevatedToken" =\> "%%1842",  
"SubjectDomainName" =\> "EXAMPLE",  
"version" =\> 2,  
"WorkstationName" =\> "-",  
"LogonType" =\> "5",  
"TargetOutboundUserName" =\> "-"

What is wrong?  
Wish help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2019, 12:18pm UTC](https://discuss.elastic.co/t/logstash-output-influxdb-problem/161509/2 "2019-01-16T12:18:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.