Grok -> patterns_dir not working in logstash 1.5.0

Elastic Stack Logstash
1

... in the same way as it did in 1.4.2

I had a complex directory structure in 1.4.2, as I noticed grok would aggregate the patterns in alphabetical order.

This gave me the ability to build a directory structure like:

grok {
patterns_dir => [
"/home/elk/ELK/logstash-1.4.2/patterns",
"/home/elk/ELK/logstash-1.4.2/config/patterns",
"/home/elk/ELK/logstash-1.4.2/proc",
"/home/elk/ELK/logstash-1.4.2/services"
]
[...]
}

A pattern could be defined in many places, and the one found in the last folder, services, would be the one used.

However by keeping the config identical and shifting the binaries to point to 1.5.0, I get the following error:
The error reported is:
pattern %{MYTEST} not defined

I removed the whole directory structure, aggregated all the pattern files into 1, which I dropped into /home/elk/ELK/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.1.10/patterns/grok-my-patterns

and now it works.

Anyone else noticed the change of behavior?

2

Yes. The behavior has changed. Since logstash-patterns-core is now a ruby gem, it will not work the same way with the patterns_dir as before. As a result, you shouldn't need to add the original patterns via a patterns_dir directive. Only new pattern directories should need to be added, as the existing patterns will always be read first.

2 Likes
4

Specify an absolute path as the pattern directory. Relative paths appear to be allowed here but I wouldn't recommend it.

2 Likes
6

please tell me how can you get the specify error like that? When i did somthing wrong in config file, it always show a mess :frowning: