unexpected error..."...probably a bug... Illegal pattern component: l"


Trying out Logstash 1.2.1, using config file from 1.1.12. Makes it through some deprecated warnings, then at end of file get the message:

An unexpected error occurred. This is probably a bug.
The error reported is: Illegal pattern component: l

Last few lines of log file:
You are using a deprecated config setting "remove" set in mutate. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"remove", lugin=><LogStash::Filters::Mutate --->, :level=>:warn}

Using milestone 2 output plugin 'elasticsearch_http'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.2.1/plugin-milestones {:level=>:warn}

An unexpected error occurred. This is probably a bug.

You can find help with this problem in a few places:


  • chat: #logstash IRC channel on freenode irc.

IRC via the web: http://goo.gl/TI4Ro

  • email: logstash-users@googlegroups.com


The error reported is:
Illegal pattern component: l

IP-address sanitized to protect the innocent:-]








                1. Output
                  output {
                  stdout { }

elasticsearch_http {
host => ''
port => 9200

  1. flush_size => 1
    } # elasticserach_http
    } # output

Note that before commenting out some lines between elasticsearch_http and the final '}', there were other warnings, so it apparently makes it to the end of file


David Welsh
October 17, 2013, 8:18 PM

Problem was with having 2 match statements in a date section [due to my Grok pattern storing variables for both the ISO8601 and BSD formats]. Resolved this on my end by using the same variable in both sections. But giving a mysterious error after parsing the rest of the file is a different behavior than it used to have.. I'll leave this out there for a little while just so it is seen, but will be glad to close it in a day or two, or have it closed.


Philippe Weber


David Welsh



Affects versions