Skip to content

Instantly share code, notes, and snippets.

@hltbra
Created October 10, 2013 20:42
Show Gist options
  • Select an option

  • Save hltbra/6925330 to your computer and use it in GitHub Desktop.

Select an option

Save hltbra/6925330 to your computer and use it in GitHub Desktop.
logstash crashes if you have an invalid ruby regex as grok pattern
# /usr/bin/java -jar /usr/share/logstash/logstash-1.1.13-monolithic.jar agent -f /etc/logstash/conf.d -w 1
Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (RegexpError) premature end of char-class: /^\\[/
at org.jruby.RubyRegexp.initialize(org/jruby/RubyRegexp.java:1267)
at org.jruby.RubyRegexp.new(org/jruby/RubyRegexp.java:729)
at RUBY.compile(jar:file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/gems/jls-grok-0.10.11/lib/grok-pure.rb:137)
at RUBY.register(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/filters/multiline.rb:146)
at RUBY.run_with_config(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/agent.rb:472)
at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149)
at RUBY.run_with_config(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/agent.rb:471)
at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)
at RUBY.run_with_config(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/agent.rb:469)
at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149)
at RUBY.run_with_config(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/agent.rb:426)
at RUBY.run(file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/logstash/agent.rb:373)
at org.jruby.RubyProc.call(org/jruby/RubyProc.java:249)
at RUBY.initialize(jar:file:/usr/share/logstash/logstash-1.1.13-monolithic.jar!/gems/stud-0.0.13/lib/stud/task.rb:12)
@hltbra
Copy link
Copy Markdown
Author

hltbra commented Oct 10, 2013

What caused the issue:

multiline {
  type => "elasticsearch"
  pattern => "^\\["
  negate => true
  what => "previous"
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment