Upgraded to 1.5.0, config check throwing errors

Elastic Stack Logstash
1

Hello!

Today I tried to upgrade from 1.4.2 to 1.5.0 on one of my nodes, but config check throws error right away:
SyntaxError: (eval):4072: syntax error, unexpected kNOT
"_grok_postfix_success" not in [tags] and
^
eval at org/jruby/RubyKernel.java:1107
initialize at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/pipeline.rb:30
execute at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/agent.rb:109
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/runner.rb:87
call at org/jruby/RubyProc.java:271
run at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.0-java/lib/logstash/runner.rb:92
call at org/jruby/RubyProc.java:271
initialize at /opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/task.rb:12

In config file, I have the following:
### Mark not parsed logs with 'drop' tag
if "_grok_postfix_success" not in [tags] {
mutate {
add_tag => [ 'drop' ]
}
}

All this works normally on 1.4.2. What am I not seeing?

Matej

2

It looks like it was a mistake on my end.
I had an 'if' statement written in multi-line instead of one.

Example:

  if  "parsed" not in [tags] and 
  "_grok_postfix_success" not in [tags] and
  "_grok_dovecot_success" not in [tags] {
    file {
      codec => json
      path => "/var/log/logstash/drop-%{type}.log"
    }
  }

instead of whole 'if' sentence in one line:

  if  "parsed" not in [tags] and "_grok_postfix_success" not in [tags] and "_grok_dovecot_success" not in [tags] {
    file {
      codec => json
      path => "/var/log/logstash/drop-%{type}.log"
    }
  }

After fixing that, there was no more errors about 'not in'.

Matej

3

This is reported here: