The original warning message is this.
"You are using a deprecated config setting "pattern" set in grok. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. You should use this instead: match => { "message" => "your pattern here" } If you have any questions about this, please visit the #logstash channel on freenode irc.""
And here is the original server config.
if [type] == "nginx-access" {
grok {
type => "nginx-access"
pattern => "%{NGINXACCESS}"
patterns_dir => ["/opt/logstash/patterns"]
}
}
So what we should do is modify the config. Using the match function to replace the pattern, like this.
if [type] == "nginx-access" {
grok {
patterns_dir => "/opt/logstash/patterns"
type => "nginx-access"
match => ["message", "%{NGINXACCESS}"]
}
}