[Resolved] Migrating from logstash 2.1 to 2.4, grok error

Elastic Stack Logstash
1

Hi,

I tried to migrate from logstash 2.1 to 2.4.

I have this grok rule in a file in the pattern directory :

RAILS_TIME %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?( %{ISO8601_TIMEZONE})?
LOGRAGE method=%{WORD:method} path=%{URIPATH:path}( format=%{DATA:format})? controller=%{DATA:controller} action=%{WORD:action} status=%{INT:status}( duration=%{NUMBER:duration})?( view=%{NUMBER:view})?( db=%{NUMBER:db})?( location=%{URI:location})?( time=%{RAILS_TIME:time})?( host=%{HOSTNAME:host})?( params=%{GREEDYDATA:params})?

The grok debugger said that there is an error : https://grokdebug.herokuapp.com

But logstash 2.1 start and work like a charm, when logstash 2.4 give me an error. I'm using the logstash docker image to test against the config file and I use volume to be sure that the file used in both 2.1 and 2.4 are the same.

In advance thanks.

2

The grok debugger said that there is an error

What is the error?

3

Compile error.

I manage to get it working. Don't know why but it seems that logstash 2.4 cannot accept more than 1 grok rule per grok file. So I put the RAILS_TIME in an another file and it worked.

4

I manage to get it working. Don't know why but it seems that logstash 2.4 cannot accept more than 1 grok rule per grok file.

No, that's not true. The pattern files that ship with Logstash include dozens of patterns.

So I put the RAILS_TIME in an another file and it worked.

Perhaps you had a line ending issue or something?

5

Maybe but what bother me is that the exact same file work with 2.(1|2|3) and not 2.4... But I'll check this out. Thanks