Hi,
I'm upgrading from LS 2.2.2 to LS 5.0 and as part of the upgrade moved the multiline filter to the file input codec but the grok filter remained unchanged. The grok pattern worked fine with LS 2.2.2 however when running LS 5.0 it terminates with the FATAL below :
[2016-10-27T13:48:40,003][ERROR][logstash.filters.grok ] Error while attempting to check/cancel excessively long grok patterns {:message=>"Mutex relocking by same thread", :class=>"ThreadError", :backtrace=>["org/jruby/ext/thread/Mutex.java:90:in `lock'", "org/jruby/ext/thread/Mutex.java:147:in `synchronize'", "c:/java8/elk5/logstash-5.0.0/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.2.3/lib/logstash/filters/grok/timeout_enforcer.rb:38:in `stop_thread_groking'", "c:/java8/elk5/logstash-5.0.0/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.2.3/lib/logstash/filters/grok/timeout_enforcer.rb:53:in `cancel_timed_out!'", "org/jruby/RubyHash.java:1342:in `each'", "c:/java8/elk5/logstash-5.0.0/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.2.3/lib/logstash/filters/grok/timeout_enforcer.rb:45:in `cancel_timed_out!'", "org/jruby/ext/thread/Mutex.java:149:in `synchronize'", "c:/java8/elk5/logstash-5.0.0/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.2.3/lib/logstash/filters/grok/timeout_enforcer.rb:44:in `cancel_timed_out!'", "c:/java8/elk5/logstash-5.0.0/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.2.3/lib/logstash/filters/grok/timeout_enforcer.rb:63:in `start!'"]}
[2016-10-27T13:48:38,941][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<InterruptedRegexpError: Regexp Interrupted>, :backtrace=>["org/jruby/RubyRegexp.java:1657:in `=~'", "org/jruby/RubyString.java:1729:in `=~'", "(eval):8618:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):8616:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):2888:in `filter_func'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/pipeline.rb:260:in `filter_batch'", "org/jruby/RubyProc.java:281:in `call'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:186:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:185:in `each'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/pipeline.rb:258:in `filter_batch'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/pipeline.rb:246:in `worker_loop'", "c:/java8/elk5/logstash-5.0.0/logstash-core/lib/logstash/pipeline.rb:225:in `start_workers'"]}The grok pattern itself is quite simple
grok {
match => { "message" => "%{OPENLINK_TIMESTAMP:openlink_timestamp}:%{OPENLINK_MODULE:openlink_module}: %{OPENLINK_LOGLEVEL:level} -%{OPENLINK_DESCRIPTION:openlink_description} >: %{OPENLINK_CODE:openlink_code} %{OPENLINK_MESSAGE:message}" }
overwrite => ["message"]
}where the patterns are
OPENLINK_TIMESTAMP %{MONTHDAY} %{MONTH} %{YEAR} %{TIME}
OPENLINK_LOGLEVEL INFORMATION|ERROR|WARNING
OPENLINK_MODULE %{DATA}
OPENLINK_CODE OL:%{DATA}
OPENLINK_DESCRIPTION %{DATA}
OPENLINK_MESSAGE (?<message>(.|\r|\n)*)Any thoughts on how I can resolve this?
Due to the length of the errors, I'll post additional error message details in a reply to this post.
Thanks,
Sanjiv