Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logstash grok with empty match is impossible to debug #123

Open
kub1x opened this issue Oct 26, 2017 · 0 comments
Open

Logstash grok with empty match is impossible to debug #123

kub1x opened this issue Oct 26, 2017 · 0 comments
Assignees

Comments

@kub1x
Copy link

kub1x commented Oct 26, 2017

Hey,
our Logstash pipeline config files are generated. There was a bug in our generation system which led to following grog pattern. The pattern was one of MANY patterns in our config and it contained override and other clauses as well, so it was not easy to notice the empty match pattern.

filter {
  grok {
    match => [ "", "" ]
  }
}

On older versions (2.4 or so) it probably worked, or at least did not vail. After update, on Logstash v5.6.3 it throws following exception. The exception doesn't say what is wrong or where in the config file we did the mistake.

LogStash::Instrument::MetricNoKeyProvided: LogStash::Instrument::MetricNoKeyProvided
     validate_key! at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/instrument/metric.rb:74
             gauge at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/instrument/metric.rb:31
             gauge at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/instrument/namespaced_metric.rb:32
          register at /home/kub1x/test/logstash-5.6.3/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.4.3/lib/logstash/filters/grok.rb:277
              each at org/jruby/RubyHash.java:1342
          register at /home/kub1x/test/logstash-5.6.3/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-3.4.3/lib/logstash/filters/grok.rb:275
          register at /home/kub1x/test/logstash-5.6.3/vendor/jruby/lib/ruby/1.9/forwardable.rb:201
   register_plugin at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/pipeline.rb:290
  register_plugins at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/pipeline.rb:301
              each at org/jruby/RubyArray.java:1613
  register_plugins at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/pipeline.rb:301
     start_workers at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/pipeline.rb:311
               run at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/pipeline.rb:235
    start_pipeline at /home/kub1x/test/logstash-5.6.3/logstash-core/lib/logstash/agent.rb:398

This is a bug in Logstash (I gusess in grok filter itself) as it should write a valuable message with a line number in config file instead of just throwing an exception.

  • Logstash Version: 5.6.3
  • Operating System: Gentoo Linux 4.9.34
@andrewvc andrewvc self-assigned this Oct 27, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants