Undeterministic error reports regarding missing pattern in grok config

Description

I got some undeterministic errors while starting up logstash. It complains about a missing pattern in my grok config.

The error is reported with a virgin directory (data directory deleted) and with a data directory from a former invocation in place.

I attached a log of my shell to this task.

Activity

Show:
Karl Skibinski
October 28, 2013, 2:49 PM

Though the config file is cat'ed within the logfile, I attach it for better reference.

Rick
October 29, 2013, 12:46 PM

This happens for me when i have more than 2 things in the filter. Commenting out the 2nd or 3rd runs as expected. Example
filter {
if [type] == "something" {
grok { *** }
}
if "name" in [tags] {
grok { *** }
}
if "otherthing" in [tags] {
grok { *** }
}
}

Johan Maasing
November 22, 2013, 1:54 PM

Ran into this while trying to learn logstash, after "hello world"-indexing 1 file I wanted to index 2 files but I don't know how to get around this.

Johan Maasing
November 24, 2013, 8:19 PM

It happens to me if I have two things in the filter OR two files in the input.

Jordan Sissel
December 3, 2013, 3:59 PM

Thank you for filing this!

I was working on this today, and I believe this to be a duplicate of LOGSTASH-1316. Follow up for this issue will appear on that ticket. Closing this one.

Assignee

Jordan Sissel

Reporter

Karl Skibinski

Affects versions

Configure