# Logstash 7.15 grok patterns directory

**URL:** <https://discuss.elastic.co/t/logstash-7-15-grok-patterns-directory/290826>\
**Category:** Logstash\
**Created:** [December 2, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-7-15-grok-patterns-directory/290826 "2021-12-02T20:25:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtudisco](https://avatars.discourse-cdn.com/v4/letter/m/3d9bf3/32.png) [@mtudisco](https://discuss.elastic.co/u/mtudisco)\
**Post date:** [December 2, 2021, 8:25pm UTC](https://discuss.elastic.co/t/logstash-7-15-grok-patterns-directory/290826/1 "2021-12-02T20:25:36Z")

</div>

Hi,  
I was running logstash 7.3, and had configured some grok patterns in a file and placed that file in  
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns/

```
After upgrading to logstash 7.15, logstash did not start indicating some of my patters were not found. I've been looking up information and did not find anyway indicating the directory change. After digging in the logstash installation directory, i found a new directory:

```

/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.3.1/patterns

it has two sub-directories, and after many try and error i finally was able to start logstash coping the grok pattern file to:  
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.3.1/patterns/legacy

```
Is there anyway it change is docummented?

```

thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 2, 2021, 8:48pm UTC](https://discuss.elastic.co/t/logstash-7-15-grok-patterns-directory/290826/2 "2021-12-02T20:48:19Z")

</div>

The fact that core patterns were upgraded to version 4.3.1 is documented in the logstash 7.12.1 release notes.

You might be better off using the patterns\_dir option on your grok filters instead of patching gems which will get removed when logstash is upgraded.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2021, 8:48pm UTC](https://discuss.elastic.co/t/logstash-7-15-grok-patterns-directory/290826/3 "2021-12-30T20:48:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.