# Logstash issue with %{UNIXPATH} in version 1.5.5 and up

**URL:** <https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122>\
**Category:** Logstash\
**Created:** [December 14, 2015, 12:28pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122 "2015-12-14T12:28:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![m1k3ga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m1k3ga/32/4173_2.png) [@m1k3ga](https://discuss.elastic.co/u/m1k3ga)\
**Post date:** [December 14, 2015, 12:28pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122/1 "2015-12-14T12:28:34Z")

</div>

In our (grok) logstash configuration we use a matching pattern like  
`"%{UNIXPATH}%{UNIXPATH:filename}"`  
with example log file entry  
`file path /opt/foo/bar/file.xml found`

Until version 1.5.4 i get a field "filename" with value "/file.xml".

Since version 1.5.5 (and 1.5.6) the log line will not be parsed at all. My logstash just hangs.  
The same behaviour appears in logstash 2.1.1 (!).

This seems a change in behaviour in logstash since version 1.5.4.  
Is this a desired behaviour or simply a bug?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 14, 2015, 12:41pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122/2 "2015-12-14T12:41:19Z")

</div>

Works fine for me, except that it doesn't match the right thing, but that's expected given the rather weird expression with two consecutive UNIXPATH patterns.

```auto
$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  grok {
    match => ["message", "%{UNIXPATH}%{UNIXPATH:filename}"]
  }
}
$ echo 'file path /opt/foo/bar/file.xml found' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
       "message" => "file path /opt/foo/bar/file.xml found",
      "@version" => "1",
    "@timestamp" => "2015-12-14T12:40:18.933Z",
          "host" => "lnxolofon",
      "filename" => "/file.xml"
}
Logstash shutdown completed

```

---

<div class="post-metadata">

**Author:** ![m1k3ga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m1k3ga/32/4173_2.png) [@m1k3ga](https://discuss.elastic.co/u/m1k3ga)\
**Post date:** [December 14, 2015, 12:56pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122/3 "2015-12-14T12:56:39Z")

</div>

Hi Magnus,  
thanks for your response.

Well, this is embarrassing 😉  
In my old terminal window it still does not work, i don't know why (there i have the same behaviour as originally described).  
Then, i opened a new terminal window and tried again, and it worked, hmmm, strange.

Thanks for the quick response.

Best regards,  
Mike

---

<div class="post-metadata">

**Author:** ![m1k3ga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m1k3ga/32/4173_2.png) [@m1k3ga](https://discuss.elastic.co/u/m1k3ga)\
**Post date:** [December 14, 2015, 1:00pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122/4 "2015-12-14T13:00:41Z")

</div>

Hi again,

your test above works for me.  
My production log file still doesn't with logstash 1.5.5/6.  
Logstash just stops parsing at the line with %{UNIXPATH}%{UNIXPATH}.  
Strange.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122/5 "2017-07-06T05:18:35Z")

</div>