Crashes Logstash when using gsub with null value for regex replacement
SteveMB1 opened this issue · 0 comments
SteveMB1 commented
In short I'm looking to replace the matched regex with nothing. Each time this happens the Logstash worker thread restarts which causes large backlogs.
- Version: Logstash 7.6.1
- Operating System: RHEL 7.7
- Config File (if you have sensitive info, please remove it): I'm using default settings for everything.
- Sample Data:
k8s_dockerapp-1_dockerapp-1
- Steps to Reproduce:
Write the following to /etc/logstash/conf.d/01-listener.conf
and try pushing data through the filter while monitoring the logstash logs with tail -f /var/log/logstash/logstash-*
.
input {
tcp {
port => 10514
codec => "json"
type => "rsyslog"
}
}
filter {
mutate {
gsub => [
"program", "k8s_|_.*", ""
]
}
}