Hello,
I have a problem with logstasth configuration. I will try to explain my problem:
I run ELK stack in Docker image on Virtual Linux machine from Win 10.
I have this part in file logstash.conf (UTF-8 LF line endings):
grok {
patterns_dir => ["/vagrant/config/patterns"]
patterns_files_glob => ["*"]
match => {"message" => "%{THREAD:log_thread}"}
}
in patterns dir is file "eps" (UTF-8 LF line endings) with my regular expressions:
THREAD ((:\d\d\d [).+?(?=]))
TRN_TYPE EPSTransaction.transactionType\s=
But when I restart logstash and check its log I see error:
logstash_1 | [2019-02-27T08:09:22,967][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{THREAD:log_thread} not defined>, :backtrace=> ...
I dont know what is wrong. When I run:
sudo find / -type f -name 'eps'
on virtual machine then I got:
/vagrant/config/patterns/eps so i mean the path is OK. Permissions for the file is also OK.
Thank you for your help.
Tomas
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.