search

lexelby / logstash-filter-concatenate

like multiline, except easier to use and with flushing enabled
0 stars 0 forks source link

Error - undefined method `filter_matched' #1

Open timukas opened 10 years ago

timukas commented 10 years ago

Hi,

I'm trying to run logstash-1.4.0.dev-flatjar.jar with you filter-concatenate plugin, but i'm getting "undefined method 'filter_matched'" errors and logstash crashes.

Here's full error message:

Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (NoMethodError) undefined method `filter_matched' for #LogStash::Event:0x4f5f1ace at RUBY.flush(/Users/dimka/logstash/logstash/filters/concatenate.rb:78) at org.jruby.RubyHash.each(org/jruby/RubyHash.java:1338) at RUBY.flush(/Users/dimka/logstash/logstash/filters/concatenate.rb:74) at RUBY.filter_flusher(file:/Users/dimka/logstash/logstash-1.4.0.dev-flatjar.jar!/logstash/pipeline.rb:283) at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613) at RUBY.filter_flusher(file:/Users/dimka/logstash/logstash-1.4.0.dev-flatjar.jar!/logstash/pipeline.rb:271) at RUBY.start_filters(file:/Users/dimka/logstash/logstash-1.4.0.dev-flatjar.jar!/logstash/pipeline.rb:147) at org.jruby.RubyProc.call(org/jruby/RubyProc.java:271) at RUBY.interval(file:/Users/dimka/logstash/logstash-1.4.0.dev-flatjar.jar!/stud/interval.rb:11) at RUBY.start_filters(file:/Users/dimka/logstash/logstash-1.4.0.dev-flatjar.jar!/logstash/pipeline.rb:147)

My concatenate config is following: concatenate { key => "%{auth}" min_flush_time => 1 max_flush_time => 5 }

I have verified, that grok parser works correctly - without concatenate filter stdout shows correctly parsed information.

Any ideas about that error?

timukas commented 10 years ago

Fixed that by replacing "entry[:event].filter_matched" to "filter_matched(entry[:event])"

But one strange things happens. After evenets are concatenated i'm searching for string from results and if "message" is matched then i'm adding field with some data. Weird thing is, that new field added to all lines, even where searching string does not exist. Any ideas?