Custom patterns in logstash that make logstash stop compiling

Elastic Stack Logstash
1

I'd written a regular expression for the particular date format in my log (created ./patterns directory and file custom_time_pattern in it):

Date format: 2013-11-05T12:05:46.123456+03:00

CUSTOMTIMESTAMP ([0-9]{4,4})\-([0-9]{2,2})\-([0-9]{2,2})([A-Za-z])(:?2[0123]|[01]?[0-9])(:?[0-5][0-9])(:?(:?[0-5]?[0-9]|60)(:?[:.,][0-9]+)?)(\+?([0-5][0-9]):?([0-9][0-9]))

And then I used it in my filter:

filter {
    if [type] == "syslog" {
        grok {
            patterns_dir => ["./patterns"]
            remove_tag => ["_grokparsefailure"]
            match => {
                "message" => ["%{CUSTOMTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(\(etc/cron\.hourly\))(?:\[%{POSINT:syslog_pid}) %{GREEDYDATA:syslog_message}", "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\]) %{GREEDYDATA:syslog_message}"]
            }
    add_field => [ "received_at", "%{@timestamp}" ]
    add_field => [ "received_from", "%{host}" ]
        }
    }  
}

And logstash stopped working (a.k.a. it doesn't compile anymore).

The problem is that with adding custom patterns logstash stops compiling entirely. And by trying out some options, I got that the problem is in that part: "%{CUSTOMTIMESTAMP:syslog_timestamp}". But I don't get the reason.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.