Hi all, I'm currently working on migrating from Logstash 7.x to logstash 8.x and it's being a bit trippy. We already used ECS so supposedly it should be straight forward, but I'm experiencing some weird errors with grok. The main one is that for some reason, in the grok filters used to assign "[host][name]", instead it assigns "[host][hostname]".
Another weird thing is that if I parse a field "[host][name]" already filled, it will autofill "[host][hostname]" automatically with what I suppose is the docker hostname. I'm guessing this is a thing in Logstash 8, but I haven't found any note regarding that...
Anyway, could somebody help me figure out the problem with the grok filters that no longer do what they are supposed to do?
Are you saying that this autofill of [host][hostname] happens in logstash (i.e. a file or stdout output shows it has happened) or are you saying that the events in elasticsearch show that autofill has occurred? If the latter then I would suggest you also look at any ingest pipelines in elasticsearch that might be transforming the documents.
Also because of some other tests I have, I am already parsing "[host][name] = host.test".
When I run logstash with these bits, I end up getting host.name = host.test and host.hostname = host-staging-01.test
Which shouldn't happen due to the overwrite... But I also have the same issue when I don't initially parse the host.name, it only populates host.hostname.
It only happens in logstash, it might be because I'm running tests on the docker version of the logstash-filter-verifier tool, and I'm parsing host variables. But still, I don't experience this problem in logstash 7.x, so I assume it must be something related to ECS.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.