Regex compiling issues

Elastic Stack Beats
1

Hi,

I have this filebeat config:

  • input_type: log
    # Paths that should be crawled and fetched. Glob based paths.
    paths:
    - /home/ohk/data/nginx.log
    document_type: nginx
    multiline.pattern: ['^\b(?:\d{1,3}.){3}\d{1,3}\b']
    multiline.negate: false
    multiline.match: after
    #############################################################
    paths:
    - /home/ohk/data/api.log
    document_type: api
    multiline.pattern: ['^INFO in ']
    multiline.negate: false
    multiline.match: after
    #############################################################
    paths:
    - /home/ohk/data/yarn.log
    document_type: yarn
    multiline.pattern: ['^LogType:']
    multiline.negate: false
    multiline.match: after
    ############################################################
    paths:
    - /home/ohk/data/worker.log
    document_type: worker
    multiline.pattern: ['^INFO in ', '^[']
    multiline.negate: false
    multiline.match: after

In filebeat log file I don't have any errors, but the journalctl mentions this:
> févr. 21 16:45:45 PCB131014 systemd[1]: Stopped filebeat.

        févr. 21 16:45:45 PCB131014 systemd[1]: Started filebeat.
        févr. 21 16:45:45 PCB131014 filebeat[18126]: panic: runtime error: invalid memory address or nil pointer dereference
    févr. 21 16:45:45 PCB131014 filebeat[18126]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x5da79a]
    févr. 21 16:45:45 PCB131014 filebeat[18126]: goroutine 42 [running]:
    févr. 21 16:45:45 PCB131014 filebeat[18126]: panic(0x8f44a0, 0xc42000e030)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /usr/local/go/src/runtime/panic.go:500 +0x1a1
    févr. 21 16:45:45 PCB131014 filebeat[18126]: regexp.progMachine(0x0, 0x0, 0xc420037448)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /usr/local/go/src/regexp/exec.go:74 +0xaa
    févr. 21 16:45:45 PCB131014 filebeat[18126]: regexp.(*Regexp).get(0xc4200ad4a0, 0xc420037528)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /usr/local/go/src/regexp/regexp.go:216 +0xd4
    févr. 21 16:45:45 PCB131014 filebeat[18126]: regexp.(*Regexp).doExecute(0xc4200ad4a0, 0x0, 0x0, 0xc4200ad5e0, 0x9b, 0x9c, 0x0, 0x0, 0x0, 0x0, ...)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /usr/local/go/src/regexp/exec.go:416 +0x40
    févr. 21 16:45:45 PCB131014 filebeat[18126]: regexp.(*Regexp).Match(0xc4200ad4a0, 0xc4200ad5e0, 0x9b, 0x9c, 0x9b)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /usr/local/go/src/regexp/regexp.go:421 +0x8c
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester/reader.genPatternMatcher.func1(0xc4200bdc00, 0x39e, 0x39f, 0xc4200ad5e0, 0x9b, 0x9c, 0x9c)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/reader/multiline.go:307 +0xa3
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester/reader.(*Multiline).readNext(0xc420110180, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/reader/multiline.go:189 +0x8b7
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester/reader.(*Multiline).readFirst(0xc420110180, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc4202f0468, ...)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/reader/multiline.go:132 +0x167
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester/reader.(*Multiline).Next(0xc420110180, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc42031ccb0, ...)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/reader/multiline.go:108 +0x62
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester/reader.(*Limit).Next(0xc4202e8ca0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/reader/limit.go:17 +0x66
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/harvester.(*Harvester).Harvest(0xc4202b9040, 0xc07180, 0xc4202e8ca0)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/harvester/log.go:93 +0x24d
    févr. 21 16:45:45 PCB131014 filebeat[18126]: github.com/elastic/beats/filebeat/prospector.(*Prospector).startHarvester.func1(0xc4200c20e0, 0xc4202b9040, 0xc07180, 0xc4202e8ca0)
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/prospector/prospector.go:248 +0x65
    févr. 21 16:45:45 PCB131014 filebeat[18126]: created by github.com/elastic/beats/filebeat/prospector.(*Prospector).startHarvester
    févr. 21 16:45:45 PCB131014 filebeat[18126]:         /go/src/github.com/elastic/beats/filebeat/prospector/prospector.go:249 +0x2e4
    févr. 21 16:45:45 PCB131014 systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
    févr. 21 16:45:45 PCB131014 systemd[1]: filebeat.service: Unit entered failed state.
    févr. 21 16:45:45 PCB131014 systemd[1]: filebeat.service: Failed with result 'exit-code'.
    févr. 21 16:45:45 PCB131014 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
    févr. 21 16:45:45 PCB131014 systemd[1]: Stopped filebeat.
    févr. 21 16:45:45 PCB131014 systemd[1]: filebeat.service: Start request repeated too quickly.
    févr. 21 16:45:45 PCB131014 systemd[1]: Failed to start filebeat.

Is there a problem with my regex ?

Thank you in advance,

2

This value cannot be an list. So remote the [ and ] from around the regex.

3

Thank you that solved the problem

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.