New Config Hash Rocket Syntax does not pass syntax check for Grok Filter


The new hash rocket syntax support in 1.2.0 (according to changelog) does not appear to pass a syntax check for grok.

Example config:

This fails with :


Matt Gibson
September 16, 2013, 10:23 PM

I've got this problem as well.

Here's the config file:

And here's the error I get.

If you remove the IF statement, it works.

Matt Gibson
September 16, 2013, 10:41 PM

Nope - I'm just an idiot.

I didn't realize that the order was Filter -> Conditional -> Grok/etc.

Robby Dyer
September 17, 2013, 1:07 PM

Ok, works when I remove the comma. I think the part of the configuration page ( that describes a Hash should be updated- it currently has the commas in there.

Luke Chavers
November 17, 2013, 12:18 PM

I had the same problem with:

.. and this seems to fix it ..

.. but the docs say that a hash has commas between values "like Ruby".

It seems intuitive to allow commas, no?

Philippe Weber
February 9, 2015, 5:56 AM

1.5 documentation is now explicit

Note that mutliple key value entries are separated by spaces rather than commas.




Philippe Weber


Robby Dyer

Fix versions

Affects versions