Logstash pattern does not work after being upgraded to 7.3.0

Elastic Stack Logstash
1

Hello,

I am trying to separate java pattern into fields. I have the following pattern set up with custom pattern setup in order to be able to process multiline fields. However since I have upgraded logstash to 7.3.0 the custom pattern does not seam to work.

     grok {
       match => { "message" => ["%{MONTH:month} %{MONTHDAY:day}, %{YEAR:year} %{TIME:time} %{WORD:day_period} %{NOTSPACE:[system][jetty][class]} %{WORD:[system][jetty][method]}\n%{GREEDYMULTILINE:multiline}",
                               "%{WORD:severity} in thread \"%{THREADNAME:threadName}\" %{GREEDYDATA:[system][jetty][data]}",
                               "%{WORD:severity} in thread \"%{THREADNAME:threadName}\" %{NOTSPACE:[system][jetty][exceptionClass]}: %{GREEDYDATA:exceptionMessage}\n %{GREEDYMULTILINE:exceptionMultiline}"
                               ] }
       pattern_definitions => {
         "GREEDYMULTILINE" => "(.|\r|\n)*",
         "THREADNAME" => "[^\"]+" }
       remove_field => "host"
    }

Has anything changed, or can I change anything in order to make that pattern work again? I have also tried in kibana grok parser but it is also failing in there.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.