Can anyone please help me with the following:
This logstash config is working fine (only with the elapsed part commented):
filter {
csv {
separator => "|"
columns => [ "datum","level","uniek","message","teller" ]
}
date {
match => [ "datum", "yyyy-MM-dd HH:mm:ss.SSSS" ]
}
if "Proces is gestart" in [message] {
mutate {
add_tag => [ "taskStarted"]
}
}
if "Proces is geeindigd" in [message] {
mutate {
add_tag => [ "taskTerminated"]
}
}
# elapsed {
# unique_id_field => "uniek"
# start_tag => "taskStarted"
# end_tag => "taskTerminated"
# timeout => 10
# }
}
When I uncomment the elapsed part (the most important part!) it crashes.
Error message is below
An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle Java::JavaLang::IllegalStateException
for PipelineAction::Create<main>
>, :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in create'", "org/logstash/execution/ConvergeResultExt.java:57:in
add'", "C:/_ELK/logstash/logstash-core/lib/logstash/agent.rb:355:in `block in converge_state'"]}