Logstash configuration - comment breaks the logstash configuration

Elastic Stack Logstash
1

Hello.

I am running Logstash 6.7.0

My config is:

input { stdin { } }
filter {
json { source => "message" }
if [Severity] == "INFO" {
#comment line 5
mutate {
add_field => {
"@timestamp" => "%{timestamp}" #comment line 8
"[event][logsource][host]" => "%{myfield}" #comment line 9
}
}
}
}
output {
stdout { codec => rubydebug }
}

I get following error:
ERROR] 2019-05-13 13:54:41.785 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 9, column 4 (byte 185) after filter {\n json { source => \"message\" }\n if [Severity] == \"INFO\" {\n#comment line 5\n mutate {\n add_field => {\n \"@timestamp\" => \"%{timestamp}\" #comment line 8\n ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in block in converge_state'"]}

Is there a way around it to slam comments into mutate section when I am using following data structure [Y][Z] ?

Seems that I am hitting some strange exception.
Any ideas?
Regards

2

Indeed. It doesn't mind a comment at the end of the hash,

        add_field => {
            "@timestamp" => "%{timestamp}"
            "[event][logsource][host]" => "%{myfield}" # This is OK!
        }

but it appears you cannot have a comment inbetween hash entries

        add_field => {
            "@timestamp" => "%{timestamp}" # This is not OK!
            "[event][logsource][host]" => "%{myfield}"
        }
3

Should I move this issue to the logstash github as a bug?
Would you classifiy this as a bug to begin with?

4

There is already an issue for it - 10053

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.