logstash-input-mongodb errors on logstash 5.1.2

Question

I'm trying to run the plugin on logstash 5.1.2, and getting the error: Direct event field references (ie event['field'] = 'value') have been disabled in favor of using event get and set methods (eg event.set('field', 'value')). Please consult the Logstash 5.0 breaking changes documentation for more details.

19:20:09.456 [LogStash::Runner] INFO logstash.inputs.mongodb - Using version 0.1.x input plugin 'mongodb'. This plugin isn't well supported by the community and likely has no maintainer.

D, [2017-02-09T19:20:09.766000 #7068] DEBUG -- : MONGODB | Adding localhost:27017 to the cluster. | runtime: 0.0000ms

D, [2017-02-09T19:20:12.839000 #7068] DEBUG -- : MONGODB | COMMAND | namespace=admin.$cmd selector={:ismaster=>1} flags=[] limit=-1 skip=0 project=nil | runtime: 3066.0000ms 19:20:12.845 [[main]-pipeline-manager] INFO logstash.inputs.mongodb - Registering MongoDB input

D, [2017-02-09T19:20:12.936000 #7068] DEBUG -- : MONGODB | COMMAND | namespace=test.$cmd selector={:listCollections=>1, :cursor=>{}, :filter=>{:name=>{"$not"=>/system.|\\$/}}} flags=[:slave_ok] limit=-1 skip=0 project=nil | runtime: 22.0001ms 19:20:13.140 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500} 19:20:13.151 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started

D, [2017-02-09T19:20:13.356000 #7068] DEBUG -- : MONGODB | QUERY | namespace=test.auditcommunications selector={:_id=>{:$gt=>BSON::ObjectId('0761b057fccc5c277c23dfbe')}} flags=[:slave_ok] limit=50 skip=0 project=nil | runtime: 224.9999ms 19:20:13.420 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600} 19:20:13.647 [[main]

Plugin: "mongodb://localhost:27017/test", placeholder_db_dir=>"/elk/logstash-mongodb/", placeholder_db_name=>"logstash_sqlite.db", collection=>"auditcommunications", batch_size=>50, id=>"797b2fd78162084f6d57991a196d656a6c95f190-1", enable_metric=>true, codec=>"plain_cd856514-8fcc-43ad-becd-9497e98577b9", enable_metric=>true, charset=>"UTF-8">, since_table=>"logstash_since", parse_method=>"flatten", isodate=>false, retry_delay=>3, generateId=>false, unpack_mongo_id=>false, message=>"Default message...", interval=>1>

Error: Direct event field references (ie event['field'] = 'value') have been disabled in favor of using event get and set methods (eg event.set('field', 'value')). Please consult the Logstash 5.0 breaking changes documentation for more details.

D, [2017-02-09T19:20:14.782000 #7068] DEBUG -- : MONGODB | QUERY | namespace=test.auditcommunications selector={:_id=>{:$gt=>BSON::ObjectId('0761b057fccc5c277c23dfbe')}} flags=[:slave_ok] limit=50 skip=0 project=nil | runtime: 128.9999ms

(sorry about the formatting)

My configuration is pretty much copy pasted from the instructions:

input {
  mongodb {
    uri => 'mongodb://localhost:27017/test'
    placeholder_db_dir => '/elk/logstash-mongodb/'
    placeholder_db_name => 'logstash_sqlite.db'
    collection => 'auditcommunications'
    batch_size => 50
  }
}

filter {
  date {
    match => [ "timestamp", "ISO8601" ]
  }
}

output {
    stdout { codec => rubydebug }
}

Am I doing something wrong or is there a problem with this plugin?

Answer 1

You're using version 0.1.x of logstash-input-mongodb , which is an old version. You should use the latest 0.4.0 version which is compatible with Logstash 5 thanks to PR #53 .

You can try to update your plugin with:

bin/logstash-plugin update logstash-input-mongodb

When done, run the following command and make sure that logstash-input-mongodb 0.4.0 is installed.

bin/logstash-plugin list --verbose

Then your plugin will work again.