Pattern: WINDOWSUSERNAME [a-zñA-Z0-9_-]+
This is preventing us from running logstash over tcp, which means dealing with UDP packet loss issues, which means we need to run logstash on LOTS more hosts then we would have to otherwise, even for a moderate amount of traffic.
pretty sure this is a bug in jruby, not sure if it's been fixed upstream yet.
Yes! Upgraded Jruby and the problem went away.
we're going to ship 1.1.1 built against jruby 184.108.40.206