Skip to content

Crashes Logstash when using gsub with null value for regex replacement #147

@SteveMB1

Description

@SteveMB1

In short I'm looking to replace the matched regex with nothing. Each time this happens the Logstash worker thread restarts which causes large backlogs.

  • Version: Logstash 7.6.1
  • Operating System: RHEL 7.7
  • Config File (if you have sensitive info, please remove it): I'm using default settings for everything.
  • Sample Data: k8s_dockerapp-1_dockerapp-1
  • Steps to Reproduce:

Write the following to /etc/logstash/conf.d/01-listener.conf and try pushing data through the filter while monitoring the logstash logs with tail -f /var/log/logstash/logstash-*.

input {
  tcp {
    port => 10514
    codec => "json"
    type => "rsyslog"
  }
}

filter {
    mutate {
      gsub => [
        "program", "k8s_|_.*", ""
      ]
    }
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions