Logstash 2.3.4 issue [solved]

[paltryeffort]

Hi,
I upgraded my logstash server to 2.3.4 using this filter.

After about a week the java process died with "out of heap space". Increasing the heap didn't help, it just took longer until the java process died.

After long hours of debugging I found a solution to this:

In the file 2030_filter_section_c_parse.conf I replaced the lines:

  grok {
    match => {
      "rawSectionC" => "(?<requestBody>.+)"
    }

with

  mutate {
    add_field => { "requestBody" => "%{rawSectionC}" }
  }

It basically just copies the field rawSectionC to requestBody. That's also what the grok is doing. For me the result is the same.

My logstash 2.3.4 server is running now a couple of weeks with this config without any issues.

For anyone using this filter with logstash 2.x you should also replace the line in the inputs from

  charset => "US-ASCII"

to

 codec => plain { charset => "US-ASCII" }

Other than that the filter is working fine for me with the new logstash version.

[bitsofinfo]

Can you please submit a pull-request w/ the affected fix? I will then create a new release

[bitsofinfo]

Also is the change backwards compatible?

[bitsofinfo]

@paltryeffort do you have a PR?

[bitsofinfo]

@paltryeffort PR?