# Metrics filter stopped working after upgrade to logstash 2.2.x

**URL:** <https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336>\
**Category:** Logstash\
**Created:** [February 21, 2016, 4:14pm UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336 "2016-02-21T16:14:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tetlika](https://avatars.discourse-cdn.com/v4/letter/t/c6cbf5/32.png) [@tetlika](https://discuss.elastic.co/u/tetlika)\
**Post date:** [February 21, 2016, 4:14pm UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336/1 "2016-02-21T16:14:05Z")

</div>

hi,

have anyone faced issue that logstash metrics stopped working after upgrade to 2.2.x?

it does not work both on 2.2.0 and 2.2.2

config is so (see below), also there is another ouptut section (to redis) in another file:

```
filter {

if [type] == "web_requests" {
    indent preformatted text by 4 spaces`if [response] =~ /^5\d\d/ or [response] =~ /^4\d\d/ {
        metrics {
            add_tag => "logstash_alarm"
            meter => "web_errors"
         }
    }
}

}

output {

   if "logstash_alarm" in [tags] and [web_errors.rate_1m] > 1 {
      pagerduty {
        description => "NUMBER OF 5xx ERRORS FATAL"
        details => {
          "timestamp" => "%{@timestamp}"
        }
        service_key => "xxxxxxx"
        incident_key => "logstash/servicename"
      }
    }

}

```

P.S.

pagerduty ouput works by itself

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 21, 2016, 8:15pm UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336/2 "2016-02-21T20:15:14Z")

</div>

Define stopped working, what is/is not happening, what are you expecting and seeing?

---

<div class="post-metadata">

**Author:** ![tetlika](https://avatars.discourse-cdn.com/v4/letter/t/c6cbf5/32.png) [@tetlika](https://discuss.elastic.co/u/tetlika)\
**Post date:** [February 22, 2016, 6:09am UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336/3 "2016-02-22T06:09:39Z")

</div>

it means that when condition of metrics filter is met, nothing is happening, I mean of this filter:

```
filter {

     if [type] == "web_requests" {
        if [response] =~ /^5\d\d/ or [response] =~ /^4\d\d/ {
            metrics {
                add_tag => "logstash_alarm"
                 meter => "web_errors"
            }
         }
    }

 }

```

also, even if I simplify the rule to this:

```
 filter {

    metrics {
        add_tag => "logstash_alarm"
        meter => "web_errors"
     }
 }

 output {

     if "logstash_alarm" in [tags] and [web_errors.rate_1m] > 1 {
         pagerduty {
             description => "NUMBER OF 5xx ERRORS FATAL"
             details => {
                 "timestamp" => "%{@timestamp}"
             }
             service_key => "xxxxxxx"
             incident_key => "logstash/servicename"
         }
       }

 }

```

also nothing is happening (when condition is met)

but if I throw out the filter metrics:

```
 output {
     pagerduty {
         description => "NUMBER OF 5xx ERRORS FATAL"
         details => {
              "timestamp" => "%{@timestamp}"
          }
         service_key => "xxxxxxx"
         incident_key => "logstash/servicename"
         }

 }

```

it work by itself, so the problem is in metrics filter, not in pagerduty

---

<div class="post-metadata">

**Author:** ![Michael\_Korbakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_korbakov/32/3199_2.png) [@Michael\_Korbakov](https://discuss.elastic.co/u/Michael_Korbakov)\
**Post date:** [February 26, 2016, 11:43am UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336/4 "2016-02-26T11:43:01Z")

</div>

You are mistaking in `[web_errors.rate_1m]` part. Documentation for plugin ([https://www.elastic.co/guide/en/logstash/current/plugins-filters-metrics.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-metrics.html)) says that in Logstash 2.x `[web_errors][rate_1m]` must be used instead.

I also suggest to change `if [response] =~ /^5\d\d/ or [response] =~ /^4\d\d/` to numerical comparison if possible. Adding `:int` qualifier to your grok pattern for `response` should be enough. Check more about type conversions in [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/metrics-filter-stopped-working-after-upgrade-to-logstash-2-2-x/42336/5 "2017-07-06T05:09:35Z")

</div>