lundi 18 juillet 2016

logstash 2.3.3 multiline filter not working with multiple workers

I have started logstash with multiple workers > 16.

I have multiline messages like java exceptions/java traces and want to merge them into a single event. Earlier, It was working as expected but after upgrading my ELK stack it's breaking :-(

my logstash filter :

filter {
  multiline {

    pattern => "(^[a-zA-Z.]+(?:Error|Exception): .+)|(^s+at .+)|(^s+... d+ more)|(^s*Caused by:.+)"
    what => "previous"
  }
}

logstash logs :

:message=>"Warning: Manual override - there are filters that might not work with multiple worker threads", :worker_threads=>16, :filters=>["multiline"], :level=>:warn}
Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.

Aucun commentaire:

Enregistrer un commentaire