Logstash Helm deploy pattern error

Hi all,

I have some problems with my value.yaml from my helm deploy of logstash 7.9 and I need some help.

This it's an example of my file:

logstashPipeline:
  logstash.conf: |
    input {
      beats {
        port => 5044
      }
    }
    filter {
      if "framework-legacy" in [tags] {
        grok {
          patterns_dir => ["/usr/share/logstash/patterns/"]
          match => {"message" => "\[%{FRAMEWORK_DATE:date}\]\[%{WORD:type}\] %{DATA:exceptionName} %{DATA:code} %{HOSTNAME:hostName} \"%{DATA:url}\" %{QUOTEDSTRING:mensaje}" }
        }
        mutate {
          add_field => { "logfile" => "%{[log][file][path]}" }
        }
        date {
          match => [ "date", "yyyy-MM-dd HH:mm:ss" ]
        }
      }
    }
    output
      if "framework-legacy" in [tags] {
        elasticsearch {
          hosts => "https://*URL_TO_ES*:443"
          index => "framework-legacy"
          ilm_enabled => false
          ssl => true
        }
      }
     
    }
logstashPatternDir: "/usr/share/logstash/patterns/"
logstashPattern:
  pattern.conf: |
    FRAMEWORK_DATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}
service:
  annotations: {}
  type: LoadBalancer
  ports:
    - name: beats
      port: 5044
      protocol: TCP
      targetPort: 5044

When I deploy the helm chart of logstash I can see an error it's tell me that the pod not found the FRAMEWORK_DATE pattern like:

[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{FRAMEWORK_DATE:fecha} not defined>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in block in compile'", "org/jruby/RubyKernel.java:1442:in loop'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in compile'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:288:in block in register'", "org/jruby/RubyArray.java:1809:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:282:in block in register'", "org/jruby/RubyHash.java:1415:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:277:in register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in block in register_plugins'", "org/jruby/RubyArray.java:1809:in each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:586:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x4aca1cf7 run>"}

Can anyone help me with any advice?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.