elastic / elastic/logstash

Logstash Codec Multiline - match is always true in debug logging

Open
#5,919 0 comments 0 reactions 1 assignee Claimed by @guyboertje View on GitHub
bug
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

Hello

Please look attached code (https://github.com/logstash-plugins/logstash-codec-multiline/blob/master/lib/logstash/codecs/multiline.rb):

```
def decode(text, &block)
text = @converter.convert(text)
text.split("\n").each do |line|
match = @grok.match(line)
@logger.debug("Multiline", :pattern => @pattern, :text => line,
:match => !match.nil?, :negate => @negate)

# Add negate option
match = (match and !@negate) || (!match and @negate)
@handler.call(line, match, &block)
end
end # def decode

```

Here `@grok.match` returns OR false OR Grok reference and in any case it will not be in Null.
so logger always write like: match => true.

It confused when debugging

Also it will be helpfully if you mention in Documentation for Multiline Codec, that it can work incorrectly with multiple workers (for example for udp input, where 2 workers is default)

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.