#! Deprecation: Specifying script source with [inline] is deprecated, use [source] instead

[Nir-Tal]

Elasticsearch version (bin/elasticsearch --version):
Version: 6.1.1, Build: bd92e7f/2017-12-17T20:23:25.338Z,

Plugins installed: []
ingest-geoip
ingest-user-agent
JVM version (java -version):
JVM: 1.8.0_151
OS version (uname -a if on a Unix-like system):
Linux elk-01 4.4.0-109-generic #132-Ubuntu SMP Tue Jan 9 19:52:39 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 16.04.3 LTS)
Description of the problem including expected versus actual behavior:
When trying to add grok ingest pipeline I get deprecation error

#! Deprecation: Specifying script source with [inline] is deprecated, use [source] instead.
{
  "acknowledged": true
}

Steps to reproduce:

PUT _ingest/pipeline/nginx-performance
{
  "description" : "extract data from nginx-performance log",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{IP:remoteAddress} %{SYSLOG5424SD:timestamp} %{WORD:method} %{URIPATHPARAM:uri} %{GREEDYDATA:httpVersion} %{NUMBER:responseCode} %{NUMBER:requestSize} %{GREEDYDATA:url} %{NUMBER:requestTime} %{NUMBER:upstreamResponseTime} %{NUMBER:upstreamConnectTime} %{NUMBER:upstreamHeaderTime}"]
      }
    }
  ]
}

Provide logs (if relevant):

[2018-01-15T22:07:43,548][DEBUG][o.e.a.b.TransportBulkAction] [%host%] failed to execute pipeline [nginx-performance] for document [filebeat-6.1.1-2018.01.15/doc/null]
org.elasticsearch.ElasticsearchException: java.lang.IllegalArgumentException: java.lang.IllegalArgumentException: Provided Grok expressions do not match field value: [69.175.97.170 [15/Jan/2018:22:08:10 +0000] GET / HTTP/1.1 200 1252 - 0.000 - - - .]
at org.elasticsearch.ingest.CompoundProcessor.newCompoundProcessorException(CompoundProcessor.java:156) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.ingest.CompoundProcessor.execute(CompoundProcessor.java:107) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.ingest.Pipeline.execute(Pipeline.java:58) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.ingest.PipelineExecutionService.innerExecute(PipelineExecutionService.java:169) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.ingest.PipelineExecutionService.access$000(PipelineExecutionService.java:42) ~[elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.ingest.PipelineExecutionService$2.doRun(PipelineExecutionService.java:94) [elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:637) [elasticsearch-6.1.1.jar:6.1.1]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.1.1.jar:6.1.1]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: java.lang.IllegalArgumentException: java.lang.IllegalArgumentException: Provided Grok expressions do not match field value: [69.175.97.170 [15/Jan/2018:22:08:10 +0000] GET / HTTP/1.1 200 1252 - 0.000 - - - .]
... 11 more
Caused by: java.lang.IllegalArgumentException: Provided Grok expressions do not match field value: [69.175.97.170 [15/Jan/2018:22:08:10 +0000] GET / HTTP/1.1 200 1252 - 0.000 - - - .]
at org.elasticsearch.ingest.common.GrokProcessor.execute(GrokProcessor.java:67) ~[?:?]
at org.elasticsearch.ingest.CompoundProcessor.execute(CompoundProcessor.java:100) ~[elasticsearch-6.1.1.jar:6.1.1]
... 9 more

[cbuescher]

Hi @Nir-Tal,

#! Deprecation:

Nothing to worry about, this is just a deprecation warning, the pipeline is added. This reminds you to change your code before the deprecated name is going away in a future version

Caused by: java.lang.IllegalArgumentException: Provided Grok expressions do not match field value: [69.175.97.170 [15/Jan/2018:22:08:10 +0000] GET / HTTP/1.1 200 1252 - 0.000 - - - .]

This error means something in the logged field content doesn't match your grok expression. I didn't dive into the details.
Questions like these are better suited to the support forums over at https://discuss.elastic.co. We prefer to use Github issues only for bug reports and feature requests, and we think it's more likely this is a question than a bug report. I'm closing this as an issue here, but encourage you to ask this question in the forum instead. Many thanks.

[fholzer]

Hi,

actually the deprecation warning is emitted whenever a pipeline is changed, even if that specific pipeline doesn't make use of the soon-to-be deprecated feature. See elastic/elasticsearch-perl#147

We observe the same behavior on our ES 6.5.4 cluster.

Cheers,
Ferdinand