New

The executive guide to generative AI

Read more

Logstash 8.17.0 Release Notes

Logstash 8.17.0 Release Notes

Known issues

JVM version changes needed when upgrading Logstash from 8.12.0 (or earlier)

If the jvm.options file was modified and not overwritten with the newest version, you may see a "deserialize invocation error" message, causing the pipeline to crash. Users are affected if the Persistent Queue (PQ) is enabled, and the pipeline is processing messages larger than 20MB.

Solution: Apply the default change contained in the newer jvm.options file, as seen in this example.

"Input buffer full" error with Logstash 8.16.0, 8.16.1, or 8.17.0

If you are using json_lines codec 3.2.0 (or later) with Logstash 8.16.0, 8.16.1, or 8.17.0, you may see an error similar to this one, crashing the pipelines:

unable to process event. {:message=>"input buffer full", :class=>"Java::JavaLang::IllegalStateException", :backtrace=>["org.logstash.common.BufferedTokenizerExt.extract(BufferedTokenizerExt.java:83)", "usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_codec_minus_json_lines_minus_3_dot_2_dot_2.lib.logstash.codecs.json_lines.RUBY$method$decode$0(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-codec-json_lines-3.2.2/lib/logstash/codecs/json_lines.rb:69)", "org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:165)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:185)",

The issue was fixed in https://github.com/elastic/logstash/pull/16760.

This problem is most likely to be seen when you are using the Logstash integration plugin to ship data between two Logstash instances, but may appear in other situations, too.

Workaround for Logstash-to-Logstash communication

The Logstash-to-Logstash issue can be mitigated by:

  • Downgrading the receiving Logstash to 8.16.2, or any Logstash in the 8.15 series, AND/OR
  • Upgrading the Logstash integration plugin of the sending Logstash to version 1.0.4.

Workaround for other json_lines codec situations

Other json_lines codec issues can be mitigated by:

  • Downgrading Logstash to 8.16.2, or any Logstash in the 8.15 series.

Notable fixes and improvements

  • Add warning that allow_superuser will default to false in 9.0.0 #16555
  • Update deprecation warning to mention ArcSight module will be removed in 9.0.0 #16648
  • Update deprecation warning for http.* settings to mention removal in 9.0.0 #16538

Changes to Logstash core

  • Make max inflight warning global to all pipelines #16601
  • Correctly guide user to use LS_JAVA_HOME instead of JAVA_HOME to configure Java on Windows #16636
  • Ensure jackson configurations are applied if found in "jvm.options" #16757
  • Set platform = 'java' in custom java plugins' gemspecs #16628
  • Fix offline installation of java plugins containing "-java" in their name #16637

Updates to dependencies

  • Pin jar-dependencies gem to 0.4.1 to avoid clashing with version bundled with JRuby #16750
  • Update JDK to 21.0.5+11 #16631

Documentation enhancements

  • Troubleshooting update for JDK bug handling cgroups v1 #16731

Plugins

Http_client Mixin - 7.5.0

  • Adds new mixin configuration option with_obsolete to mark ssl options as obsolete #46