# Logstash doesn't parse logs after upgrading from 1.5.x to 6.5.x

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115>\
**Category:** Logstash\
**Created:** [December 3, 2018, 8:27am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115 "2018-12-03T08:27:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tbodhini](https://avatars.discourse-cdn.com/v4/letter/t/8edcca/32.png) [@tbodhini](https://discuss.elastic.co/u/tbodhini)\
**Post date:** [December 3, 2018, 8:27am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115/1 "2018-12-03T08:27:52Z")

</div>

Hi all,

my problem is the following: After upgrading "some" major versions, my logstash config doesn't work as expected anymore. I configured on several different containers and it should process the logs like before. On some hosts it doesn't even process the logs, on others only from the first file input. Was there any change, which could have broken my config? Only thing I changed, was the json\_lines delimiter syntax.  
Graylog version didn't change and I did the upgrade, because I refactored my logconfig from longer time ago.  
Didn't touch anything else than my own logstash-forward.conf, thought acout configuring pipelines.yml, because I have up to 4 different patterns of logs in my hosts.

input {  
file {  
path =\> "/opt/java-app/logs/catalina.out"  
sincedb\_path =\> "/opt/java-applogstash/sincedb/_opt\_java-app\_logs\_catalina.out"  
tags =\> ['streams-java-apps','timeformat\_java']  
codec =\> multiline {  
pattern =\> "^%{TIMESTAMP\_ISO8601}"  
negate =\> "true"  
what =\> "previous"  
max\_lines =\> 50000  
}  
}  
if "timeformat\_java" in [tags] {  
grok {  
match =\> {  
"message" =\> "%{TIMESTAMP\_ISO8601:timestamp}"  
}  
}  
grok {  
match =\> {  
"message" =\> "%{LOGLEVEL:loglevel}"  
}  
}  
grok {  
match =\> {  
"message" =\> "%{JAVAEX:exception}"  
}  
}  
date {  
# 2015-06-26 09:45:14,439  
match =\> ["timestamp","ISO8601","YYYY-MM-dd HH:mm:ss,SSS","YYYY-MM-dd HH:mm:ss.SSS","YYYY-MM-dd HH:mm:ss"]  
}  
kv { prefix =\> "param_" }  
}  
ruby {  
code =\> "event.set('timestamp', '%10.3f' % event.get('@timestamp').to\_f)"  
}  
mutate {  
convert =\> {"timestamp" =\> "float"}  
}  
mutate {  
remove\_field =\> ["message","@timestamp","@version"]  
}  
}  
output {  
tcp {  
host =\> "graylog-host"  
port =\> "12201"  
codec =\> json\_lines {  
delimiter =\> 0  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![tbodhini](https://avatars.discourse-cdn.com/v4/letter/t/8edcca/32.png) [@tbodhini](https://discuss.elastic.co/u/tbodhini)\
**Post date:** [December 3, 2018, 9:02am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115/2 "2018-12-03T09:02:01Z")

</div>

Here are my logs ... this is the only message I'm seeing ...

[2018-11-29T11:20:36,459][WARN][logstash.outputs.tcp] tcp output exception {:host=\>"1.2.3.4", :port=\>12201, :exception=\>#\<EOFError: End of file reached\>, :backtrace=\>["org/jruby/RubyIO.java:2965:in `sysread'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-tcp-5.0.3/lib/logstash/outputs/tcp.rb:156:in`block in register'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-json\_lines-3.0.6/lib/logstash/codecs/json\_lines.rb:48:in `encode'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-tcp-5.0.3/lib/logstash/outputs/tcp.rb:201:in`receive'", "/opt/logstash/logstash-core/lib/logstash/outputs/base.rb:89:in `block in multi_receive'", "org/jruby/RubyArray.java:1734:in`each'", "/opt/logstash/logstash-core/lib/logstash/outputs/base.rb:89:in `multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:114:in`multi\_receive'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:97:in `multi_receive'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:373:in`block in output\_batch'", "org/jruby/RubyHash.java:1343:in `each'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:372:in`output\_batch'", "/optlogstash/logstash-core/lib/logstash/pipeline.rb:324:in `worker_loop'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:286:in`block in start\_workers'"]}

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [December 3, 2018, 9:45am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115/3 "2018-12-03T09:45:40Z")

</div>

Can you try the output port number not in quotes?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2018, 9:45am UTC](https://discuss.elastic.co/t/logstash-doesnt-parse-logs-after-upgrading-from-1-5-x-to-6-5-x/159115/4 "2018-12-31T09:45:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.