Logstash grok regex threw exception


(Dee) #1

Hi,
I'm migrating grok patterns from logstash 2.3 to logstash 6.2, so far its going well, except for my syslog logs.
This is the grok pattern I have:

if [type] == "syslog" {
    grok {
    	break_on_match => false
        match => {"message" => "%{MONTH} %{MONTHDAY} %{TIME} %{WORD:action}: %{NOTSPACE:package}"}
        match => {"message" => "%{SYSLOGBASE}"}
        add_tag => ["grokked"]
    }
    date {
    	match => ["timestamp", "ISO8601", "MMM dd HH:mm:ss", "dd-MM-yyyy HH:mm:ss", "dd-MM-yyyy HH:mm:ss:SSS", "dd-MM-yyyy HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "HH:mm:ss", "MMM  dd HH:mm:ss"]
      remove_field => ["timestamp"]
    }
  }

And I am getting this exception:

{"level":"WARN","loggerName":"logstash.filters.grok","timeMillis":1520521822400,"thread":"Ruby-0-Thread-17@[main]>worker2: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:384","logEvent":{"message":"Grok regexp threw exception","exception":"incompatible encoding regexp match (UTF-8 regexp with ASCII-8BIT string)","backtrace":["org/jruby/RubyRegexp.java:1107:in match'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:182:inexecute'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok/timeout_enforcer.rb:20:in grok_till_timeout'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:342:inblock in match_against_groks'","org/jruby/RubyArray.java:1734:in each'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:339:inmatch_against_groks'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:328:in match'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:296:inblock in filter'","org/jruby/RubyHash.java:1343:in each'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:295:infilter'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:inblock in multi_filter'","org/jruby/RubyArray.java:1734:in each'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:inmulti_filter'","/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:47:in multi_filter'","(eval):214:inblock in initialize'","org/jruby/RubyArray.java:1734:in each'","(eval):210:inblock in initialize'","(eval):166:in block in filter_func'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:447:infilter_batch'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"],"class":"Encoding::CompatibilityError"}}

Any idea why this is happening?
Thanks!


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.