# Logstash error after upgrade (of ElasticSearch, Kibana and Logstash) from 7.16.3 to 7.17.29 **URL:** \ **Category:** Logstash\ **Created:** [September 23, 2025, 10:04am UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158 "2025-09-23T10:04:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![milligal\_capita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milligal_capita/32/141260_2.png) [@milligal\_capita](https://discuss.elastic.co/u/milligal_capita)\ **Post date:** [September 23, 2025, 10:04am UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158/1 "2025-09-23T10:04:13Z")
No log ingestion. Logstash wont stay up. Error in logs: [ERROR][logstash.javapipeline][main] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1442:in `loop'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in `compile'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.3/lib/logstash/filters/grok.rb:282:in `block in register'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.3/lib/logstash/filters/grok.rb:276:in `block in register'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.3/lib/logstash/filters/grok.rb:271:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:233:in `block in register\_plugins'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:232:in `register\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:599:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:245:in `start\_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:190:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:142:in `block in start'"], "pipeline.sources"=\>["/etc/logstash/conf.d/logstash.conf"], :thread=\>"#\"} We tested manual index/shard creation using REST API which worked fine, but think there is some problem with config since the upgrade. Any help or advice welcome. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [September 23, 2025, 12:39pm UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158/2 "2025-09-23T12:39:34Z")
> [@milligal\_capita](#): > > Grok::PatternError: pattern %{DATAINBRACKETS:log\_date} not defined Where in your configuration do you think you have defined the DATAINBRACKETS pattern? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [September 23, 2025, 12:44pm UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158/3 "2025-09-23T12:44:14Z")
> [@milligal\_capita](#): > > \ This is a custom pattern, is not one of the default GROK patterns from Logstash. Probably you had this pattern defined on a file inside Logstash installation path, which would change after the upgrade. You need to recreate this custom pattern and configure your grok filter to use it, it is better to define custom patterns on an external file not part of the installation path. ---
**Author:** ![milligal\_capita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milligal_capita/32/141260_2.png) [@milligal\_capita](https://discuss.elastic.co/u/milligal_capita)\ **Post date:** [September 24, 2025, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158/4 "2025-09-24T09:29:00Z")
This is resolved, the original relative path meant the patterns file couldnt be found, after the upgrade it seems we needed to provide an absolute path to the patterns file. Thanks for your responses though.