grok patterns give error of 'not defined' when used in filter
Description
Gliffy Diagrams
Activity
Jordan Sissel December 3, 2013 at 4:31 PM
To the best of my knowedge, this is now resolved with: https://github.com/logstash/logstash/pull/821
Ashwin Jayaprakash November 22, 2013 at 5:43 PM
I can confirm that taking "web" off made it work immediately. I've also noticed that this failure happens with "web" quite often. When it does happen, LS refuses to start even after repeated start attempts.
Perhaps this is because of the unpacking of JARs? Does it cache or store them somewhere which subsequent restarts can reuse? If the unpacking fails once because the messages arrive before the patterns are loaded, the cached directories are reused for the next startup attempt also?
I've noticed that the logs are different on failure and on success. I think there is a threading issue. I don't see the message that says it has read all the patterns when it fails.
Failure:
Success:
Dana Kashubeck-Personal November 15, 2013 at 6:14 PM
Using 1.2.2
I have defined custom patterns in an external file and pointed to the directory that contains the pattern file in my grok definitions. Spinning up Logstash locally, I receive this error sometimes, but not all the time. I have been able to simply kill it and restart it and everything loads fine. Custom patterns work as expected.
Perhaps a load order issue?
Oluf Lorenzen November 6, 2013 at 1:57 PM
also affects 1.2.2
Jeremiah Pierucci November 5, 2013 at 4:40 PM
Also, for anyone else struggling with this problem if you fire up the agent separate from the web interface, the problem goes away as well.
Jeremiah Pierucci November 5, 2013 at 12:25 AMEdited
Same problem here running on Windows 7. It must be a timing issue. A super simple config file never had the problem but as I added more to it the config file the problem happens more often. Taking "web" off startup makes the problem go away and pointing manually to a local patterns directory also makes the problem go away.
Yohann Lepage October 10, 2013 at 1:16 AM
I confirm the issue.
The same config file works on my laptop. No issue without web option.
when using a pattern that previously worked in version 1.1.13, an error message shows stating that the pattern {TIME:time} is not defined.
This is the filter setup
i noticed that pattern was deprecated, so i tried match, same results
interesting that the time pattern works in the codec, but not in the filter.
—
as a workaround, i extracted the patterns folder, and used that path in the pattern_dir attribute. This fixed the issue.
I think that the grok filter is not correctly getting to the /patterns folder when it is in a jar