{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/6037","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/6037/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/6037/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/6037/events","html_url":"https://github.com/elastic/logstash/issues/6037","id":182577571,"number":6037,"title":"Test and exit misses config issue","user":{"login":"DigiAngel","id":947191,"avatar_url":"https://avatars.githubusercontent.com/u/947191?v=3","gravatar_id":"","url":"https://api.github.com/users/DigiAngel","html_url":"https://github.com/DigiAngel","followers_url":"https://api.github.com/users/DigiAngel/followers","following_url":"https://api.github.com/users/DigiAngel/following{/other_user}","gists_url":"https://api.github.com/users/DigiAngel/gists{/gist_id}","starred_url":"https://api.github.com/users/DigiAngel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DigiAngel/subscriptions","organizations_url":"https://api.github.com/users/DigiAngel/orgs","repos_url":"https://api.github.com/users/DigiAngel/repos","events_url":"https://api.github.com/users/DigiAngel/events{/privacy}","received_events_url":"https://api.github.com/users/DigiAngel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-12T16:53:36Z","updated_at":"2016-10-12T17:50:34Z","closed_at":"2016-10-12T17:41:07Z","body":"- Version: 5 Beta\r\n- Operating System: Ubuntu 16.04, oracle-java8-installer 8u101+8u101arm-1~webupd8~2\r\n- Config File:\r\n~~~\r\ninput {\r\n        file {\r\n                type => \"connlog\"\r\n                path => \"/opt/bro/spool/bro/conn.log\"\r\n                sincedb_path => \"/var/lib/logstash/.sincedbconn\"\r\n        }\r\n}\r\n\r\nfilter {\r\n\r\n                grok {\r\n                        match => { \"message\"=> \"(?<unixtime>(.*?))\\t(?<uid>(.*?))\\t(?<src_ip>(.*?))\\t(?<src_port>(.*?))\\t(?<dst_ip>(.*?))\\t(?<dst_port>(.*?))\\t(?<proto>(.*?))\\t(?<service>(.*?))\\t(?<duration>(.*?))\\t(?<orig_bytes>(.*?))\\t(?<resp_bytes>(.*?))\\t(?<conn_state>(.*?))\\t(?<local_orig>(.*?))\\t(?<local_resp>(.*?))\\t(?<missed_bytes>(.*?))\\t(?<history>(.*?))\\t(?<orig_packts>(.*?))\\t(?<orig_ip_bytes>(.*?))\\t(?<resp_packts>(.*?))\\t(?<resp_ip_bytes>(.*?))\\t(?<tun_parent>(.*))\\t(?<protosig>(.*))\" }\r\n                }\r\n\r\n                geoip {\r\n                        source => \"src_ip\"\r\n                        target => \"src_geoip\"\r\n                }\r\n\r\n                geoip {\r\n                        source => \"dst_ip\"\r\n                        target => \"dst_geoip\"\r\n                }\r\n                mutate {\r\n                        convert => { \"resp_bytes\" => \"integer\" }\r\n                        convert => { \"resp_ip_bytes\" => \"integer\" }\r\n                        convert => { \"orig_bytes\" => \"integer\" }\r\n                        convert => { \"orig_ip_bytes\" => \"integer\" }\r\n                        convert => { \"src_ip\" => \"ip\" }\r\n                        convert => { \"dst_ip\" => \"ip\" }\r\n                        gsub => [\r\n                        \"ids_alert\", \"[ \\-\\(\\)\\/\\:]\",  \"_\",\r\n                        \"src_geoip.country_name\", \"[ ]\", \"_\",\r\n                        \"dst_geoip.country_name\", \"[ ]\", \"_\",\r\n                        \"proto\", \"tcp\", \"TCP\",\r\n                        \"proto\", \"udp\", \"UDP\",\r\n                        \"proto\", \"icmp\", \"ICMP\"\r\n                        ]\r\n                }\r\n}\r\n\r\n\r\noutput {\r\n        stdout { codec => rubydebug }\r\n        #elasticsearch {\r\n        #        hosts => [\"192.168.1.8\"]\r\n        #}\r\n}\r\n~~~\r\n- Sample Data: Initial testing\r\n- Steps to Reproduce: below\r\n~~~\r\n[10:06:43 @tester:/var/log/logstash$] sudo -u logstash /usr/share/logstash/bin/logstash --path.settings=/etc/logstash -f /etc/logstash/conf.d -t\r\nConfiguration OK\r\n~~~\r\n\r\nbut starting gives me:\r\n~~~\r\n[2016-10-12T10:02:17,308][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<LogStash::ConfigurationError: translation missing: en.logstash.agent.configuration.invalid_plugin_register>, :backtrace=>[\"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.1/lib/logstash/filters/mutate.rb:178:inregister'\", \"org/jruby/RubyHash.java:1342:in each'\", \"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.1/lib/logstash/filters/mutate.rb:172:inregister'\", \"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:197:in start_workers'\", \"org/jruby/RubyArray.java:1613:ineach'\", \"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:197:in start_workers'\", \"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:153:inrun'\", \"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:250:in start_pipeline'\"]}\r\n~~~\r\n\r\nSo either a) field type of \"ip\" is no longer valid and the test and exit misses it, or b) field type of \"ip\" IS valid, and logstash itself has an issue.  Thank you."},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/253286909","html_url":"https://github.com/elastic/logstash/issues/6037#issuecomment-253286909","issue_url":"https://api.github.com/repos/elastic/logstash/issues/6037","id":253286909,"user":{"login":"DigiAngel","id":947191,"avatar_url":"https://avatars.githubusercontent.com/u/947191?v=3","gravatar_id":"","url":"https://api.github.com/users/DigiAngel","html_url":"https://github.com/DigiAngel","followers_url":"https://api.github.com/users/DigiAngel/followers","following_url":"https://api.github.com/users/DigiAngel/following{/other_user}","gists_url":"https://api.github.com/users/DigiAngel/gists{/gist_id}","starred_url":"https://api.github.com/users/DigiAngel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DigiAngel/subscriptions","organizations_url":"https://api.github.com/users/DigiAngel/orgs","repos_url":"https://api.github.com/users/DigiAngel/repos","events_url":"https://api.github.com/users/DigiAngel/events{/privacy}","received_events_url":"https://api.github.com/users/DigiAngel/received_events","type":"User","site_admin":false},"created_at":"2016-10-12T17:50:34Z","updated_at":"2016-10-12T17:50:34Z","body":"Truth be told it's the first time I've used it :D  My older ELK stack supported convert to type \"ip\"...looks like this was another change, so I wanted to test.  Ironically however, from the 5.0 help:\r\n~~~\r\nNote that grok patterns are not checked for correctness with this flag. \r\n~~~\r\nwhich of course is exactly what I was doing 8-|.  Thanks again Aaron...I appreciate your help every time I post."}}
{"actor":{"display_login":"DigiAngel"}}