Question

Does anybody know what is error?

  #/usr/java/jre1.7.0/bin/java -cp /home/spatel/logstash logstash.runner agent -f logstash-syslog.conf
    Grok::PatternError: pattern %{IPORHOST:device} not defined
              compile at /home/spatel/logstash/gems/jls-grok-0.10.7/lib/grok-pure.rb:131
                 loop at org/jruby/RubyKernel.java:1410
              compile at /home/spatel/logstash/gems/jls-grok-0.10.7/lib/grok-pure.rb:91
              compile at /home/spatel/logstash/gems/jls-grok-0.10.7/lib/grok/pure/pile.rb:51
             register at /home/spatel/logstash/logstash/filters/grok.rb:142
                 each at org/jruby/RubyArray.java:1615
             register at /home/spatel/logstash/logstash/filters/grok.rb:140
                 each at org/jruby/RubyHash.java:1186
             register at /home/spatel/logstash/logstash/filters/grok.rb:126
      run_with_config at /home/spatel/logstash/logstash/agent.rb:415
      run_with_config at /home/spatel/logstash/logstash/agent.rb:414
                 each at org/jruby/RubyArray.java:1615
      run_with_config at /home/spatel/logstash/logstash/agent.rb:412
      run_with_config at /home/spatel/logstash/logstash/agent.rb:369
                  run at /home/spatel/logstash/logstash/agent.rb:318
    Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (SystemExit) pattern %{IPORHOST:device} not defined
            at org.jruby.RubyIO.write(org/jruby/RubyIO.java:1361)
            at org.jruby.RubyIO.write(org/jruby/RubyIO.java:2342)
            at org.jruby.RubyIO.puts(org/jruby/RubyIO.java:2297)
            at org.jruby.RubyIO.puts(org/jruby/RubyIO.java:2289)
            at logstash.runner.main(logstash/runner.rb:42)
            at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1615)
            at logstash.runner.main(logstash/runner.rb:41)
            at logstash.runner.(root)(logstash/runner.rb:120)

Answer 1

You get that error when Logstash cannot find that pattern in any of it’s pattern files.
The simplest fix would be to use the patterns_dir directive in logstash-syslog.conf for your filter(s).