The new hash rocket syntax support in 1.2.0 (according to changelog) does not appear to pass a syntax check for grok.
Example config:
This fails with :
I've got this problem as well.
Here's the config file:
And here's the error I get.
If you remove the IF statement, it works.
Nope - I'm just an idiot.
I didn't realize that the order was Filter -> Conditional -> Grok/etc.
Ok, works when I remove the comma. I think the part of the configuration page (http://logstash.net/docs/1.2.1/configuration) that describes a Hash should be updated- it currently has the commas in there.
I had the same problem with:
.. and this seems to fix it ..
.. but the docs say that a hash has commas between values "like Ruby".
It seems intuitive to allow commas, no?
1.5 documentation is now explicit
Note that mutliple key value entries are separated by spaces rather than commas.
From http://www.elasticsearch.org/guide/en/logstash/current/configuration.html#hash