Logstash GREEDYMULTILINE

[bogomop (Brian)]

getting this error when trying to start logstash

[2017-05-11T12:35:56,772][ERROR][logstash.filters.grok ] Unknown setting 'pattern_definitions' for grok
[2017-05-11T12:35:56,795][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}

using the example from

https://www.elastic.co/guide/en/logstash/5.4/logstash-config-for-filebeat-modules.html#parsing-system

I think its this that is causing the problem

pattern_definitions => {
"GREEDYMULTILINE"=> "(.|\n)*"
}

any idea where I can get the pattern for GREEDYMULTILINE, I seem to be missing it on Debian

[magnusbaeck (Magnus Bäck)]

The pattern_definitions grok option is only available in recent versions of the grok filter. Try updating it. Otherwise you can put the pattern in a pattern file.

[bogomop (Brian)]

thanks for that. I did the following and it start ok now

cd /usr/share/logstash/bin/
./logstash-plugin update logstash-filter-grok