Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sporadic "An unexpected error occurred" while starting up logstash #77

Open
orpiske opened this issue Sep 25, 2013 · 2 comments
Open

Sporadic "An unexpected error occurred" while starting up logstash #77

orpiske opened this issue Sep 25, 2013 · 2 comments

Comments

@orpiske
Copy link

orpiske commented Sep 25, 2013

I am facing a, possible, issue with logstash 1.2.1. Sporadically, when starting it up, I receive the following error:

java -jar logstash-1.2.1-flatjar.jar agent -f conf/logstash.conf -- web
----------
Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.2.1/plugin-milestones {:level=>:warn}
+---------------------------------------------------------+
| An unexpected error occurred. This is probably a bug.   |
| You can find help with this problem in a few places:    |
...
The error reported is: 
  pattern %{GREEDYDATA:message_id} not defined

My configuration file looks like this:

input {
       file {
        type => "my-component"
        path => [ "/path/to/my/log/directory/*.log" ]
        add_field => [ "API", "mycomponent"]
    }
      ...
}
filter {

    if [type] == "my-component" { 
        grok {  
            match => [ "message", "(%{GREEDYDATA:message_id}) %{TIMESTAMP_ISO8601:log_timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message_remainder}" ]
            add_field => ["raw_message", "%{@message}"]
        }
        mutate {
            replace => ["message", "%{message_remainder}" ]
        }   
        multiline {
            pattern => "^\s"
            what => "previous"
        }
    }
}

output {
    elasticsearch { embedded => true }
}

It works if I kill it and start it again.

@mirkokiefer
Copy link

Just had the same problem in v1.2.2.

@electrical
Copy link

The issue is the 'web' part.
For some reason it causes it grok to lose the pattern dir.

best solution we have for now is to run the web part separately

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants