Grok singles option is broken for complex patterns
Description
Gliffy Diagrams
Activity
Show:
Philippe Weber August 1, 2014 at 7:37 AM
Fabio Napoleoni September 21, 2013 at 4:41 PM
Hi Richard, afaik the issue is still present in the latest 1.1.x release but is not present in the latest 1.2.x.
Richard Pijnenburg September 21, 2013 at 3:17 PM
Hi,
Is this still an issue with the latest release?
Fabio Napoleoni April 20, 2013 at 9:50 AM
Yes, this is the output on my working copy. However I haven't upgraded logstash sources, I run this from the code in my github fork with
Rspec output
$ git clone git://github.com/fabn/logstash.git
$ cd logstash && bundle install
$ rspec spec/filters/grok.rb
The source :rubygems is deprecated because HTTP requests are insecure.
Please change your source to 'https://rubygems.org' if possible, or 'http://rubygems.org' if not.
Run options: exclude {:slow=>true}
.F.........
Failures:
1) LogStash::Filters::Grok complex syslog line "Oct 2 06:55:04 mail20 postfix/smtp[17714]: B89F93C..." when processed
Failure/Error: Unable to find matching line from backtrace
Insist::Failure:
Expected "B89F93CC26", but got ["B89F93CC26"]
# ./spec/filters/grok.rb:47:in `(root)'
Finished in 0.115 seconds
11 examples, 1 failure
Failed examples:
rspec ./spec/test_utils.rb:68 # LogStash::Filters::Grok complex syslog line "Oct 2 06:55:04 mail20 postfix/smtp[17714]: B89F93C..." when processedJordan Sissel April 20, 2013 at 6:36 AM
Can you include the spec output showing the failure?
Duplicate
Details
Details
Assignee
Logstash Developers
Logstash DevelopersReporter
Fabio Napoleoni
Fabio NapoleoniAffects versions
Created October 17, 2012 at 4:23 PM
Updated August 1, 2014 at 7:37 AM
Resolved August 1, 2014 at 7:37 AM
I tried the new singles option with the patterns I'm working on and I found out that for some fields it doesn't work. I wasn't able to debug the issue since I don't know enough logstash internals, but I was able to reproduce the issue in a spec, you can find that in this branch
https://github.com/fabn/logstash/tree/singles-option-issue
The strange thing is with those data some fields are kept into arrays and for some others the single option is applied with no issues.
I did not make a pull request since in order to reproduce the issue I had to add my patterns file to the patterns directory and that file is not production ready, so you should not merge it.