The new hash rocket syntax support in 1.2.0 (according to changelog) does not appear to pass a syntax check for grok.
This fails with :
I've got this problem as well.
Here's the config file:
And here's the error I get.
If you remove the IF statement, it works.
Nope - I'm just an idiot.
I didn't realize that the order was Filter -> Conditional -> Grok/etc.
Ok, works when I remove the comma. I think the part of the configuration page (http://logstash.net/docs/1.2.1/configuration) that describes a Hash should be updated- it currently has the commas in there.
I had the same problem with:
.. and this seems to fix it ..
.. but the docs say that a hash has commas between values "like Ruby".
It seems intuitive to allow commas, no?