[Logstash] Pattern set in grok.

The original warning message is this.

"You are using a deprecated config setting "pattern" set in grok. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. You should use this instead: match => { "message" => "your pattern here" } If you have any questions about this, please visit the #logstash channel on freenode irc.""

And here is the original server config.

if [type] == "nginx-access" {
  grok {
    type => "nginx-access"
    pattern => "%{NGINXACCESS}"
    patterns_dir => ["/opt/logstash/patterns"]
  }
}

So what we should do is modify the config. Using the match function to replace the pattern, like this.

if [type] == "nginx-access" {
  grok {
    patterns_dir => "/opt/logstash/patterns"
    type => "nginx-access"
    match => ["message", "%{NGINXACCESS}"]
  }
}
This entry was posted in Logstash. Bookmark the permalink.