unknown variant grok_parser

[bmgante]

Hi All,

Just using latest vector release and when insalling vector through ansible role with the default config i get the error:

May 18 17:53:06 obs-dev vector[27551]: Failed to load ["/etc/vector/vector.toml"]
May 18 17:53:06 obs-dev vector[27551]: ------------------------------------------
May 18 17:53:06 obs-dev vector[27551]: x unknown variant `grok_parser`, expected one of `aggregate`, `aws_ec2_metadata`, `dedupe`, `filter`, `log_to_metric`, `lua`, `metric_to_log`, `reduce`, `remap`, `route`, `sample`, `tag_cardinality_limit`, `throttle`
May 18 17:53:06 obs-dev vector[27551]: in `transforms.grok`

Below my config:

[root@obs-dev ~]# cat /etc/vector/vector.toml
# Set global options
data_dir = "/var/lib/vector"


[sinks.console]
    encoding.codec = "json"
    inputs = ["grok"]
    type = "console"

[sources.journald]
    current_boot_only = true
    type = "journald"

[transforms.grok]
    inputs = ["journald"]
    pattern = "(?<capture>\\d+)%{GREEDYDATA}"
    type = "grok_parser"

Can someone help on this? Thanks

[spencergilbert]

It sounds like the ansible setup is using an outdated configuration, they should update that on their end. You can see the upgrade guide that references the deprecation of that transform here.

[bmgante]

@spencergilbert but ansible role is using latest vector release. What config are you talking about exactly? Can you provide some guidance?
Thanks

[spencergilbert]

Assuming you're using this, the default configuration includes grok_parser which was deprecated in 0.22.0 and removed in the following release.

The maintainer of that repo would need to update the configuration they're shipping, as it's been invalid for several versions.

[jszwedko]

Ah, I think the issue is that you are using a new Version of Vector that dropped the grok_parser transform. You can see how to migrate to using a remap transform here: https://vector.dev/highlights/2022-05-03-0-22-0-upgrade-guide/#grok_parser

[bmgante]

Ok got it. Will update the config to use remap instead.
Thanks for the guidance