Logstash 1.5.0 writing the event to the failure file, Bug?

[remotesyssupport]

To capture the messages that fail grok, I write to a file

# Catch grok failures
output {
   if [type] == "syslog" and "_grokparsefailure" in [tags] {
       file { path => "/mnt/log/logstash/failed_syslog-%{+YYYY-MM-dd}" }
   }
}

But instead, in the error I see

"File: the event tried to write outside the files root, writing the event to the failure file"

And the events are written to

/mnt/log/logstash/failed_syslog-/_filepath_failures

Am I doing something wrong or is it a bug?

[wiibaa]

there is indeed a bug in how the root path is calculated by the plugin, because it takes everything before %{ so it expects to write into this folder in fact /mnt/log/logstash/failed_syslog-/ and :boom:

@remotesyssupport a possible workaroud is to use this config path => "/mnt/log/logstash/%{type}/failed_syslog-%{+YYYY-MM-dd}"then the plugin should behave correctly in term of root path validation

@ph sorry to steal away preliminary exploration, but I let you the fun of fixing it :D

[ph]

@wiibaa I don't miss all the fun! Thanks for confirming it! @remotesyssupport I'll take your bug report, fix it, add a test and release a new gem for it.

[remotesyssupport]

Thanks @wiibaa and @ph

[ph]

I have released a new version of the logstash-output-file gem. You can update your local plugin with:

bin/plugin update logstash-output-file