{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/6167","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/6167/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/6167/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/6167/events","html_url":"https://github.com/elastic/logstash/issues/6167","id":186792244,"number":6167,"title":"logstash crashing on providing database attribute for geoip","user":{"login":"darshanime","id":6951919,"avatar_url":"https://avatars.githubusercontent.com/u/6951919?v=3","gravatar_id":"","url":"https://api.github.com/users/darshanime","html_url":"https://github.com/darshanime","followers_url":"https://api.github.com/users/darshanime/followers","following_url":"https://api.github.com/users/darshanime/following{/other_user}","gists_url":"https://api.github.com/users/darshanime/gists{/gist_id}","starred_url":"https://api.github.com/users/darshanime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/darshanime/subscriptions","organizations_url":"https://api.github.com/users/darshanime/orgs","repos_url":"https://api.github.com/users/darshanime/repos","events_url":"https://api.github.com/users/darshanime/events{/privacy}","received_events_url":"https://api.github.com/users/darshanime/received_events","type":"User","site_admin":false},"labels":[{"id":90997092,"url":"https://api.github.com/repos/elastic/logstash/labels/bug","name":"bug","color":"e11d21","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-02T12:51:54Z","updated_at":"2016-11-03T05:26:12Z","closed_at":null,"body":"I am running logstash:latest in a docker container. It hangs up without any error on using paths. If I comment out the paths(`geoip->database` or I don't use `grok->pattern`) in my logstash.conf (provided below), it works fine.\r\n\r\n- Version: logstash:latest\r\n- Operating System: Ubuntu 14.04\r\n- Config File (if you have sensitive info, please remove it):\r\n\r\n**patterns/django**:\r\n```\r\nDJANGO_LOGLEVEL (DEBUG|INFO|ERROR|WARNING|CRITICAL)\r\n```\r\n**logstash.conf**:\r\n```\r\ninput {\r\n    udp {\r\n        port => 55555\r\n        codec => json\r\n    }\r\n\r\n    tcp {\r\n        port => 55554\r\n        codec => json\r\n        type => \"devknox\"\r\n\t}\r\n\r\n    syslog {\r\n        port => 54320\r\n        type => \"django\"\r\n    }\r\n}\r\n\r\nfilter {\r\n\r\n     if [type] == \"django\" {\r\n        grok {\r\n          patterns_dir => \"/etc/logstash/patterns\"\r\n          pattern => \"%{DJANGO_LOGLEVEL}\"\r\n        }\r\n    }\r\n\r\n     if [type] == \"devknox\" {\r\n\r\n        geoip {\r\n          source => \"userip\"\r\n          target => \"geoip\"\r\n          database => \"/etc/logstash/GeoIP/GeoLiteCity.dat\"\r\n          add_field => [ \"[geoip][coordinates]\", \"%{[geoip][longitude]}\" ]\r\n          add_field => [ \"[geoip][coordinates]\", \"%{[geoip][latitude]}\"  ]\r\n        }\r\n\r\n        mutate {\r\n          convert => [ \"[geoip][coordinates]\", \"float\"]\r\n        }\r\n     }\r\n}\r\n\r\noutput {\r\n\telasticsearch {\r\n\t\thosts => \"elasticsearch:9200\"\r\n\t}\r\n}\r\n```\r\nLogstash exits with this:\r\n```\r\nlogstash_1       | Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties.\r\nelk_logstash_1 exited with code 1\r\n```\r\nIt writes no logs to `/var/log/logstash`\r\n```\r\n--> dc run logstash ls -l /var/log/logstash/\r\ntotal 0\r\n```\r\n\r\nHere is the Dockerfile for ref:\r\n```\r\nFROM logstash:latest\r\nCOPY ./config/logstash.conf /etc/logstash/conf.d/logstash.conf\r\nCOPY ./GeoLiteCity.dat /etc/logstash/GeoIP/GeoLiteCity.dat\r\nCOPY ./patterns/django /etc/logstash/patterns/django\r\n```\r\n\r\n\r\nIt also doesn't seem to take the settings from command line. I start my logstash container with in my `docker-compose.yml`:\r\n```\r\nlogstash:\r\n  build: logstash/\r\n  command: logstash -f /etc/logstash/conf.d/logstash.conf --log.level trace\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/258066763","html_url":"https://github.com/elastic/logstash/issues/6167#issuecomment-258066763","issue_url":"https://api.github.com/repos/elastic/logstash/issues/6167","id":258066763,"user":{"login":"darshanime","id":6951919,"avatar_url":"https://avatars.githubusercontent.com/u/6951919?v=3","gravatar_id":"","url":"https://api.github.com/users/darshanime","html_url":"https://github.com/darshanime","followers_url":"https://api.github.com/users/darshanime/followers","following_url":"https://api.github.com/users/darshanime/following{/other_user}","gists_url":"https://api.github.com/users/darshanime/gists{/gist_id}","starred_url":"https://api.github.com/users/darshanime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/darshanime/subscriptions","organizations_url":"https://api.github.com/users/darshanime/orgs","repos_url":"https://api.github.com/users/darshanime/repos","events_url":"https://api.github.com/users/darshanime/events{/privacy}","received_events_url":"https://api.github.com/users/darshanime/received_events","type":"User","site_admin":false},"created_at":"2016-11-03T05:26:12Z","updated_at":"2016-11-03T05:26:12Z","body":"@jarpy, thanks for the tip! I was under the impression that if the container is running already, it won't run the command in a new clone, but the original one. \r\n\r\n@talevy, I have switched to the official image and I can see the logs in my STDOUT. However, it logstash refuses to accept the GeoIP file. I get it using: \r\n```\r\ncurl -O \"http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz\"\r\ngunzip GeoLiteCity.dat.gz\r\n```\r\n\r\n"}}
{"actor":{"display_login":"darshanime"}}