Mutate lowercase and gsub no longer working since upgrade

[WillemDH]

A big issue that I noted with the lowercase mutate filter is that if the field is already lowercase and it attempts to run through the lowercase mutate filter, the entire field will be dropped. I think this is a new bug, and it's important to be aware of.

This seem like a bigger bug then the lowercase filter not applying? Maybe I better wait for you guys to decide it's time to upgrade. In fact I was hoping it was possible to only update the mutate plugin.

Let's put this thread on hold for now.

Thanks for the effort you put in it.

[jolson]

Please read my second edit:

EDIT2: Updating the mutate filter after running the above procedure fixes the lowercase removal problem!

Code: Select all

/usr/local/nagioslogserver/logstash/bin/plugin update logstash-filter-mutate
service logstash restart

[WillemDH]

Ah, nice. And upgrading Logstash now will not cause issues the next NLS update? And for the updated logstash-filter-mutate to work I need Logstash 1.5.4?

[jolson]

Good news!



Updating just the plugin appears to work. This is all you'll need to do:

Code: Select all

/usr/local/nagioslogserver/logstash/bin/plugin update logstash-filter-mutate
service logstash restart

I feel like a bonehead for investing so much time into my previous post.

[WillemDH]

Hehe, that was actually what I suggested in my first post in this thread today.

Is there some way to implement this fix with just an update of the mutate plugin? Or does NLS need to be updated for that to work?

But at least you know that Logstash 1.5.4 seems to work fine. I will update the plugin tomorrow and probably confirm it is working. Then we can bury this thread...

[jolson]

Sounds good - looking forward to your results.

[WillemDH]

The lowercase mutate filter seems to work correctly now. Thanks Jesse. Please close.

[jolson]

No problem - will do.