LogStash silently stops sending all events to the output when an input message fails to match a grok pattern

Description

See the attached files for a repro case.

There are three lines printed by generate_lines.sh. The second one does not match the grok pattern specified in logstash_bug.conf. The expected behavior is that every second, all three lines would be printed to STDOUT, and the second one would have the '_grokparsefailure' tag attached.

Instead, only the first event is printed to STDOUT, and LogStash never prints the third line or any others. Nor does it log anything to STDERR.

One bug is that the expected behavior does not match what's happening, but a more serious issue is that events are not processed in isolation. An error in a filter shouldn't prevent an event from being sent to the output, nor should it affect other events from being processed.

Assignee

Logstash Developers

Reporter

TuckerS

Labels

Fix versions

Affects versions

Configure