elastic / elastic/logstash

UDP listener died, GELF output with collectd thresholds.

Open
#3,888 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
1d 4h
Merged PRs (30d)
88

Description

Hi!

I am experiencing a crash of logstash 1.5.4 when it is about to output events via gelf to the graylog server (1.1.6-1). The message generator is collectd 5.5.0 which sends events to logstash using network/threshold mechanism.

The cause is as follows:

NoMethodError: undefined method `downcase' for 1:Fixnum
receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-gelf-1.0.0/lib/logstash/outputs/gelf.rb:200
handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/outputs/base.rb:88
output_func at (eval):123
outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:244
start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:166
UDP listener died {:exception=>#, :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-1.0.0/lib/logstash/inputs/udp.rb:79:in`udp_listener'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-1.0.0/lib/logstash/inputs/udp.rb:49:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:177:in`inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:171:in `start_input'"], :level=>:warn}

This problem didn't exist in Logstash version 1.4.5-1 which I have tested.
Commenting out the gelf section below prevents Logstash from crashing.

Logstash config:

```
input {
udp {
add_field => { "short_message" => "collectd" }
port => 25826
codec => collectd {}
buffer_size => 1400
type => "linux-collectd"
}
}

output {
stdout
{
codec => rubydebug
}
gelf {
host => "10.12.21.10"
port => 12201
}
}
```

collectd config:

```

FSType "ext4"
FSType "xfs"
ValuesPercentage True

Server "127.0.0.1" "25826"



Instance "*"
WarningMin 20
FailureMin 10
Instance "free"
DataSource "value"

```

Contributor guide

Open the contributing guide

Research direction

Start at logstash-output-gelf-1.0.0/lib/logstash/outputs/gelf.rb:200 and inspect the value passed to downcase when collectd threshold events are sent. Compare the UDP listener path in logstash-input-udp-1.0.0/lib/logstash/inputs/udp.rb:79, then reproduce with the provided Logstash and collectd configurations. Done means threshold events reach the GELF output without crashing Logstash or killing the UDP listener.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
backend, networking, observability-sre
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.