[2022-11-17T09:26:38,925][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.8.23"}
[2022-11-17T09:26:42,617][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"NoMethodError", :message=>"undefined method `close' for nil:NilClass", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:83:in `add_patterns_from_file'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-codec-multiline-3.0.11/lib/logstash/codecs/multiline.rb:162:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-codec-multiline-3.0.11/lib/logstash/codecs/multiline.rb:160:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-codec-multiline-3.0.11/lib/logstash/codecs/multiline.rb:155:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/codecs/base.rb:18:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:255:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:184:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):8:in `initialize'", "org/jruby/RubyKernel.java:1061:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}
Input file is:
input {
file {
path => "/var/log/aerospike/aerospike.log"
type => "asd"
start_position => "end" # Default = end
codec => multiline {
patterns_dir=> ["/etc/logstash/multi_pattern"]
pattern => "%{HISTOGRAM}|%{AS_HEADER}stacktrace: %{AS_REST:stacktrace}"
what => "previous"
}
}
}
filter {
if [type] == "asd" {
grok {
match => {
"path" => ["/logs/%{GREEDYDATA:logfile}"]
}
}
if "multiline" in [tags] {
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => {
"message" => ["%{HIST_START}(%{SPACE})+%{AS_REST:histograms}"]
}
}
# histograms are saved into the 'histograms' field from the previous grok
mutate {
gsub => [
# remove everything before the double spaces
"histograms", ".*(\s{2})",""
]
}
kv{
value_split => ": "
field_split => "() "
target => "histogram"
source => "histograms"
remove_field => [ "histograms" ]
}
ruby {
code => "
kv = event.get('histogram')
kv.to_hash.keys.each { |k|
kv[k] = kv[k].to_i
}
event.set('histogram',kv)
"
}
} else {
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => {
"message" => ["%{AS_NS}","%{AS_TICK}","%{AS_NSUP}","%{AS_XDR}","%{AS_SINDEX}","%{AS_ERR}","%{AS_LOG}"]
}
}
}
date {
match => [ "logdate", "MMM dd YYYY HH:mm:ss ZZZ", "MMM d YYYY HH:mm:ss ZZZ"]
}
}
}
output {
elasticsearch {
hosts => "xxxxxx"
index => 'aerospike-%{+YYYY.MM.dd}'
}
}
