Logstash crashes on start-up with grok pattern file

Description

I recently upgraded logstash to 1.1.0 from 1.0.17. I run it in a centralized setup and elasticsearch is running on 0.18.7. I tweaked the config file to remove some legacy stuff that was valid in 1.0.17. Everything works fine if I remove the grok filter from the config file. Here is the error that I'm getting:

/opt/logstash/bin$ sudo java -jar logstash-1.1.0-monolithic.jar agent -f /opt/logstash/logstash-indexer.conf
[sudo] password for emre:
I, [2012-02-07T21:42:19.772000 #9288] INFO – : Using beta plugin 'amqp'. For more information about plugin statuses, see http://logstash.net/docs/1.1.0/plugin-status {"timestamp":"2012-02-07T21:42:19.751000 +0000","message":"Using beta plugin 'amqp'. For more information about plugin statuses, see http://logstash.net/docs/1.1.0/plugin-status ","level":"info"}
I, [2012-02-07T21:42:20.074000 #9288] INFO – : Using beta plugin 'syslog'. For more information about plugin statuses, see http://logstash.net/docs/1.1.0/plugin-status {"timestamp":"2012-02-07T21:42:20.730000 +0000","message":"Using beta plugin 'syslog'. For more information about plugin statuses, see http://logstash.net/docs/1.1.0/plugin-status ","level":"info"}
ArgumentError: negative string size (or size too big)
gsub at org/jruby/RubyString.java:2914
gsub at org/jruby/RubyString.java:2882
add_patterns_from_file at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/gems/jls-grok-0.9.6/lib/grok-pure.rb:60
each at org/jruby/RubyIO.java:3141
add_patterns_from_file at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/gems/jls-grok-0.9.6/lib/grok-pure.rb:56
compile at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/gems/jls-grok-0.9.6/lib/grok/pure/pile.rb:49
each at org/jruby/RubyArray.java:1612
compile at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/gems/jls-grok-0.9.6/lib/grok/pure/pile.rb:48
register at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/filters/grok.rb:143
each at org/jruby/RubyArray.java:1612
register at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/filters/grok.rb:141
each at org/jruby/RubyHash.java:1175
register at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/filters/grok.rb:127
run_with_config at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:382
run_with_config at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:382
each at org/jruby/RubyArray.java:1612
run_with_config at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:380
run_with_config at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:340
run at file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:304
Exception in thread "LogStash::Agent" org.jruby.exceptions.RaiseException: (SystemExit) negative string size (or size too big)
at #<Class:0x2143ed74>.method_missing(file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/builtin/javasupport/java.rb:51)
at LogStash:rogram.exit(file:/opt/logstash/bin/logstash-1.1.0-monolithic.jar!/logstash/program.rb:9)
at logstash.runner.main(logstash/runner.rb:46)
at logstash.runner.(root)(logstash/runner.rb:108)

See attachment for config files & let me know if more info is needed.

Assignee

Logstash Developers

Reporter

Emre Yildirim

Labels

Fix versions

Affects versions

Configure