Hi all,
I have some problems with my value.yaml from my helm deploy of logstash 7.9 and I need some help.
This it's an example of my file:
logstashPipeline:
logstash.conf: |
input {
beats {
port => 5044
}
}
filter {
if "framework-legacy" in [tags] {
grok {
patterns_dir => ["/usr/share/logstash/patterns/"]
match => {"message" => "\[%{FRAMEWORK_DATE:date}\]\[%{WORD:type}\] %{DATA:exceptionName} %{DATA:code} %{HOSTNAME:hostName} \"%{DATA:url}\" %{QUOTEDSTRING:mensaje}" }
}
mutate {
add_field => { "logfile" => "%{[log][file][path]}" }
}
date {
match => [ "date", "yyyy-MM-dd HH:mm:ss" ]
}
}
}
output
if "framework-legacy" in [tags] {
elasticsearch {
hosts => "https://*URL_TO_ES*:443"
index => "framework-legacy"
ilm_enabled => false
ssl => true
}
}
}
logstashPatternDir: "/usr/share/logstash/patterns/"
logstashPattern:
pattern.conf: |
FRAMEWORK_DATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}
service:
annotations: {}
type: LoadBalancer
ports:
- name: beats
port: 5044
protocol: TCP
targetPort: 5044
When I deploy the helm chart of logstash I can see an error it's tell me that the pod not found the FRAMEWORK_DATE pattern like:
[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{FRAMEWORK_DATE:fecha} not defined>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in
block in compile'", "org/jruby/RubyKernel.java:1442:in loop'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in
compile'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:288:in block in register'", "org/jruby/RubyArray.java:1809:in
each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:282:in block in register'", "org/jruby/RubyHash.java:1415:in
each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:277:in register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in
register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in block in register_plugins'", "org/jruby/RubyArray.java:1809:in
each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:586:in
maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in
run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x4aca1cf7 run>"}
Can anyone help me with any advice?