logstash-plugins / logstash-filter-mutate

Apache License 2.0
16 stars 75 forks source link

Crashes Logstash when using gsub with null value for regex replacement #147

Open SteveMB1 opened 4 years ago

SteveMB1 commented 4 years ago

In short I'm looking to replace the matched regex with nothing. Each time this happens the Logstash worker thread restarts which causes large backlogs.

Write the following to /etc/logstash/conf.d/01-listener.conf and try pushing data through the filter while monitoring the logstash logs with tail -f /var/log/logstash/logstash-*.

input {
  tcp {
    port => 10514
    codec => "json"
    type => "rsyslog"
  }
}

filter {
    mutate {
      gsub => [
        "program", "k8s_|_.*", ""
      ]
    }
}