Logstash getting syntax errors after upgrading to 7.13.3

Question

So my company has me upgrading our Logstash version for our repository to 7.13.3 from 6.6.2.

After fixing some of the other errors with the upgrade, it seems the last piece is to change the ruby syntax in the config file.

However, I am not too familiar with the language and not sure why the syntax no longer works.

Here is an example of one of the syntax errors we get from the file.

[2021-07-21T16:10:22,524][ERROR][logstash.javapipeline    ][main] Pipeline error {
  :pipeline_id=>"main",
  :exception=>#<RegexpError: unmatched range specifier in char-class: /(?<ucd_environment_name1>(?<=release_ucd_environment_name:)[\w-.]*)/m>,
  :backtrace=>[
    "org/jruby/RubyRegexp.java:965:in `initialize'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:127:in `compile'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.0/lib/logstash/filters/grok.rb:282:in `block in register'",
    "org/jruby/RubyArray.java:1809:in `each'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.0/lib/logstash/filters/grok.rb:276:in `block in register'",
    "org/jruby/RubyHash.java:1415:in `each'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.0/lib/logstash/filters/grok.rb:271:in `register'",
    "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:228:in `block in register_plugins'",
    "org/jruby/RubyArray.java:1809:in `each'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:227:in `register_plugins'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:586:in `maybe_setup_out_plugins'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:240:in `start_workers'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'",
    "/Users/808451090/Desktop/app/logstash-7.13.3/logstash-core/lib/logstash/java_pipeline.rb:137:in `block in start'"
  ],
  "pipeline.sources"=>["/Users/808451090/Desktop/app/logstash-7.13.3/devops-jenkins/jenkins.conf"],
  :thread=>"#<Thread:0x4fbac51b run>"
}

The line this error references:

grok {
    match => { "message_string" => "(?<ucd_environment_name1>(?<=release_ucd_environment_name:)[\w-.]*)" }
  }

There are other lines where this error occurs, but they all have similar syntax to this line so I'm sure I can apply the same change to those ones too.

If anyone can point me to how I can change this line to check for the same expression that this Logstash version accepts syntactically.

Answer 1

The error is

unmatched range specifier in char-class

In character definitions, you can define ranges of characters as eg [az] . When using a literal dash character there, you have to be careful to either escape it or to make sure it unambiguously defines a single character rather than a range.

In your example, you can just escape the dash in your regex to make sure the dash is regarded as a single possible character:

grok {
  match => { "message_string" => "(?<ucd_environment_name1>(?<=release_ucd_environment_name:)[\w\-.]*)" }
}