Logstash 7.15 grok patterns directory

Elastic Stack Logstash
1

Hi,
I was running logstash 7.3, and had configured some grok patterns in a file and placed that file in
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns/

After upgrading to logstash 7.15, logstash did not start indicating some of my patters were not found. I've been looking up information and did not find anyway indicating the directory change. After digging in the logstash installation directory, i found a new directory:

/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.3.1/patterns

it has two sub-directories, and after many try and error i finally was able to start logstash coping the grok pattern file to:
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.3.1/patterns/legacy

Is there anyway it change is docummented?

thanks

2

The fact that core patterns were upgraded to version 4.3.1 is documented in the logstash 7.12.1 release notes.

You might be better off using the patterns_dir option on your grok filters instead of patching gems which will get removed when logstash is upgraded.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.