Page 2 of 2
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 2:55 pm
by WillemDH
A big issue that I noted with the lowercase mutate filter is that if the field is already lowercase and it attempts to run through the lowercase mutate filter, the entire field will be dropped. I think this is a new bug, and it's important to be aware of.
This seem like a bigger bug then the lowercase filter not applying? Maybe I better wait for you guys to decide it's time to upgrade. In fact I was hoping it was possible to only update the mutate plugin.
Let's put this thread on hold for now.
Thanks for the effort you put in it.
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 2:57 pm
by jolson
Please read my second edit:
EDIT2: Updating the mutate filter after running the above procedure fixes the lowercase removal problem!
Code: Select all
/usr/local/nagioslogserver/logstash/bin/plugin update logstash-filter-mutate
service logstash restart
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 3:12 pm
by WillemDH
Ah, nice. And upgrading Logstash now will not cause issues the next NLS update? And for the updated logstash-filter-mutate to work I need Logstash 1.5.4?
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 3:43 pm
by jolson
Good news!
Updating just the plugin appears to work. This is all you'll need to do:
Code: Select all
/usr/local/nagioslogserver/logstash/bin/plugin update logstash-filter-mutate
service logstash restart
I feel like a bonehead for investing so much time into my previous post.
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 4:15 pm
by WillemDH
Hehe, that was actually what I suggested in my first post in this thread today.
Is there some way to implement this fix with just an update of the mutate plugin? Or does NLS need to be updated for that to work?
But at least you know that Logstash 1.5.4 seems to work fine. I will update the plugin tomorrow and probably confirm it is working. Then we can bury this thread...
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Tue Sep 15, 2015 4:16 pm
by jolson
Sounds good - looking forward to your results.
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Wed Sep 16, 2015 7:02 am
by WillemDH
The lowercase mutate filter seems to work correctly now. Thanks Jesse. Please close.
Re: Mutate lowercase and gsub no longer working since upgrad
Posted: Wed Sep 16, 2015 9:11 am
by jolson
No problem - will do.