The original warning message is this.
|
1 2 |
"You are using a deprecated config setting "pattern" set in grok. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. You should use this instead: match => { "message" => "your pattern here" } If you have any questions about this, please visit the #logstash channel on freenode irc."" |
And here is the original server config.
|
1 2 3 4 5 6 7 8 |
if [type] == "nginx-access" { grok { type => "nginx-access" pattern => "%{NGINXACCESS}" patterns_dir => ["/opt/logstash/patterns"] } } |
So what we should do is modify the config. Using the match function to replace the pattern, like this.
|
1 2 3 4 5 6 7 8 |
if [type] == "nginx-access" { grok { patterns_dir => "/opt/logstash/patterns" type => "nginx-access" match => ["message", "%{NGINXACCESS}"] } } |