Logstash crash on windows with grok filter
Description
Gliffy Diagrams
Activity
Show:

Nikos March 6, 2014 at 10:57 PM
Resolved with most recent version

Jason Kendall March 5, 2014 at 5:43 PM
I see a bunch of debug and info logging, no errors. Can you expand on this?
Hi,
I'm trying apply a grok filter on logstash 1.1.13 under windows.
But it crash just after I run logstash.
Here a log extract :
{:timestamp=>"2013-06-13T03:16:13.454000+0200", :message=>"Read config", :level=>:info, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/logging.rb", :line=>"37", :method=>"info"}
{:timestamp=>"2013-06-13T03:16:18.588000+0200", :message=>"Start thread", :level=>:info, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/logging.rb", :line=>"37", :method=>"info"}
{:timestamp=>"2013-06-13T03:16:19.700000+0200", :message=>"Using beta plugin 'file'. For more information about plugin statuses, see http://logstash.net/docs/1.1.13/plugin-status ", :level=>:info, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"188", :method=>"validate_plugin_status"}
{:timestamp=>"2013-06-13T03:16:19.150000+0200", :message=>"config LogStash::Inputs::File/@path = [\"C:\\\\blueway\\\\BluewayV54Engine\\\\log\\\\server.log\"]", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.180000+0200", :message=>"config LogStash::Inputs::File/@type = \"blueway\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.210000+0200", :message=>"config LogStash::Inputs::File/@debug = true", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.230000+0200", :message=>"config LogStash::Inputs::File/@format = \"plain\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.260000+0200", :message=>"config LogStash::Inputs::File/@sincedb_path = \"C:\\\\logstash\\\\sincedb\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.280000+0200", :message=>"config LogStash::Inputs::File/@charset = \"UTF-8\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.310000+0200", :message=>"config LogStash::Inputs::File/@add_field = {}", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.330000+0200", :message=>"config LogStash::Inputs::File/@stat_interval = 1", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.360000+0200", :message=>"config LogStash::Inputs::File/@discover_interval = 15", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.380000+0200", :message=>"config LogStash::Inputs::File/@sincedb_write_interval = 15", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.390000+0200", :message=>"config LogStash::Inputs::File/@start_position = \"end\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.650000+0200", :message=>"config LogStash::Filters::Grok/@type = \"blueway\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.680000+0200", :message=>"config LogStash::Filters::Grok/@patterns_dir = [\"file:/C:/logstash/grok_patterns.txt\"]", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.700000+0200", :message=>"config LogStash::Filters::Grok/@pattern = [\"%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:level}%{SPACE}%{GREEDYDATA:message}\"]", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.720000+0200", :message=>"config LogStash::Filters::Grok/@add_tag = [\"level_%{level}\"]", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.740000+0200", :message=>"config LogStash::Filters::Grok/@tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.760000+0200", :message=>"config LogStash::Filters::Grok/@exclude_tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.780000+0200", :message=>"config LogStash::Filters::Grok/@remove_tag = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.790000+0200", :message=>"config LogStash::Filters::Grok/@add_field = {}", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.820000+0200", :message=>"config LogStash::Filters::Grok/@match = {}", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.840000+0200", :message=>"config LogStash::Filters::Grok/@drop_if_match = false", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.860000+0200", :message=>"config LogStash::Filters::Grok/@break_on_match = true", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.880000+0200", :message=>"config LogStash::Filters::Grok/@named_captures_only = true", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.900000+0200", :message=>"config LogStash::Filters::Grok/@keep_empty_captures = false", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.920000+0200", :message=>"config LogStash::Filters::Grok/@singles = false", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.940000+0200", :message=>"config LogStash::Filters::Grok/@tag_on_failure = [\"_grokparsefailure\"]", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.106000+0200", :message=>"config LogStash::Filters::Mutate/@type = \"blueway\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.108000+0200", :message=>"config LogStash::Filters::Mutate/@replace = {\"@source_host\"=>\"VM-ETL-DEV\", \"@source\"=>\"Blueway\"}", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.109000+0200", :message=>"config LogStash::Filters::Mutate/@tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.112000+0200", :message=>"config LogStash::Filters::Mutate/@exclude_tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.114000+0200", :message=>"config LogStash::Filters::Mutate/@add_tag = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.116000+0200", :message=>"config LogStash::Filters::Mutate/@remove_tag = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.118000+0200", :message=>"config LogStash::Filters::Mutate/@add_field = {}", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.161000+0200", :message=>"Using beta plugin 'tcp'. For more information about plugin statuses, see http://logstash.net/docs/1.1.13/plugin-status ", :level=>:info, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"188", :method=>"validate_plugin_status"}
{:timestamp=>"2013-06-13T03:16:19.167000+0200", :message=>"config LogStash::Outputs::Tcp/@host = \"15.89.0.56\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.168000+0200", :message=>"config LogStash::Outputs::Tcp/@port = 5141", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.170000+0200", :message=>"config LogStash::Outputs::Tcp/@mode = \"client\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.172000+0200", :message=>"config LogStash::Outputs::Tcp/@type = \"\"", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.174000+0200", :message=>"config LogStash::Outputs::Tcp/@tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.176000+0200", :message=>"config LogStash::Outputs::Tcp/@exclude_tags = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.178000+0200", :message=>"config LogStash::Outputs::Tcp/@fields = []", :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/config/mixin.rb", :line=>"88", :method=>"config_init"}
{:timestamp=>"2013-06-13T03:16:19.181000+0200", :message=>"Starting input", lugin=><LogStash::Inputs::File path=>["C:\\blueway\\BluewayV54Engine\\log
server.log"], type=>"blueway", format=>"plain", sincedb_path=>"C:\\logstash
sincedb", charset=>"UTF-8", start_position=>"end">, :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/logging.rb", :line=>"35", :method=>"debug"}
{:timestamp=>"2013-06-13T03:16:19.185000+0200", :message=>"Starting thread", lugin=><LogStash::Inputs::File path=>["C:\\blueway\\BluewayV54Engine\\log
server.log"], type=>"blueway", format=>"plain", sincedb_path=>"C:\\logstash
sincedb", charset=>"UTF-8", start_position=>"end">, :thread=>1, :level=>:debug, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/logging.rb", :line=>"35", :method=>"debug"}
{:expand_path=>["file:/C:/logstash/logstash-1.1.13-flatjar.jar!/addressable/idna/../../../data/unicode.data", "file:/C:/logstash/logstash-1.1.13-flatjar.jar!/data/unicode.data"]}
{:timestamp=>"2013-06-13T03:16:29.227000+0200", :message=>"Grok patterns path", atterns_dir=>["file:/C:/logstash/logstash-1.1.13-flatjar.jar!/logstash/filters/../../patterns/*", "file:/C:/logstash/grok_patterns.txt"], :level=>:info, :file=>"/logstash/logstash-1.1.13-flatjar.jar!/logstash/logging.rb", :line=>"37", :method=>"info"}
Here my config file
input {
file {
path => "C:\blueway\BluewayV54Engine\log\server.log"
type => "blueway"
debug => "true"
format => "plain"
sincedb_path => "C:\logstash\sincedb"
}
}
filter {
grok {
type => "blueway"
pattern => "%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{LOGLEVEL:level}%{SPACE}%{GREEDYDATA:message}"
add_tag => [ "level_%{level}" ]
}
mutate {
type => "blueway"
replace => [ "@source_host", "VM-ETL-DEV" ]
replace => [ "@source", "Blueway" ]
}
}
output {
tcp {
host => "xxxxxxxxxx"
port => "5141"
mode => "client"
}
}
If I remove grok filter it work.
Where is my mistake ?
Thanks.
Nikos