Getting warning messages in logstash for grok patterns

Elastic Stack Logstash
1

I am getting the below warning messages in logstash logs and index is not creating for the same.
Error:[WARN ][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>45, "name"=>"[Talend_Pipeline]<beats", "current_call"=>"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats" ,"current_call"=>"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.0.0-java/lib/logstash/inputs/beats.rb:204:in `run'"}], ["LogStash::Filters::Grok", {"match"=>{"message"=>["(?<Response_Time>%{MONTHDAY}\s*%{MONTH .....

I did not get what exactly causing the issue.

Thanks in Advance for your help!!!

2

I have used 12 grok patterns in my config file. IS this advisable to use multiple grok patterns.
Below are the sample patterns looks like
["(?<Response_Time>%{MONTHDAY}\s*%{MONTH}\s*%{YEAR}\s*%{HOUR}\s*%{HOUR}:%{MINUTE}:%{SECOND}) \| %{WORD:Log_level} \| %{DATA} \| %{DATA} %{NUMBER} \| %{NUMBER} - %{DATA} \|%{SPACE}%{WORD:Message_type}%{SPACE}Message__ID: %{NUMBER:Message_Id}__Response-Code: %{NUMBER:Response-Code}__Content-Type: %{DATA}__Headers: %{GREEDYDATA}Payload: %{GREEDYDATA:Response_Payload}", "%{GREEDYDATA:data}(?<Response_Time>%{MONTHDAY}\s*%{MONTH}\s*%{YEAR}\s*%{HOUR}\s*%{HOUR}:%{MINUTE}:%{SECOND}) \| %{WORD:Log_level} \| %{DATA} \| %{DATA} %{NUMBER} \| %{NUMBER} - %{DATA} \|%{SPACE}%{WORD:Message_type}%{SPACE}Message__ID: %{NUMBER:Message_Id}__Response-Code: %{NUMBER:Response-Code}__Content-Type: %{DATA}__Headers: %{GREEDYDATA}__Payload: %{GREEDYDATA:Response_Payload}"]

3

Can you give a couple of examples of the events you are trying to parse?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.