elastic / elastic/logstash

[2.3.1] Multiline - ConcurrencyError

Open
#5,318 3 comments 0 reactions 1 assignee Claimed by @guyboertje View on GitHub
bug
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
1d 4h
Merged PRs (30d)
88

Description

2 Logstash servers via RR DNS receiving Java stack traces via udp. After the error, it stops processing messages on that port. Port is still up & listening. We're listening on other ports as well, that are not multiline, and they continue working.

```
{:timestamp=>"2016-05-17T21:07:36.970000-0700", :message=>"Exception in inputworker", "exception"=>#, "backtrace"=>["org/jruby/RubyArray.java:1147:in `<<'", "org/jruby/RubyArray.java:1168:in `push'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-multiline-2.0.11/lib/logstash/codecs/multiline.rb:204:in `buffer'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-multiline-2.0.11/lib/logstash/codecs/multiline.rb:262:in `do_previous'", "org/jruby/RubyMethod.java:124:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-multiline-2.0.11/lib/logstash/codecs/multiline.rb:198:in `decode'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-multiline-2.0.11/lib/logstash/codecs/multiline.rb:191:in `decode'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:96:in `inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-2.0.5/lib/logstash/inputs/udp.rb:73:in `udp_listener'"], :level=>:error}
```

```
input {
udp {
port => 9119
type => "error_log"
codec => multiline {
pattern => "^<%{NONNEGINT:prifacil}>(%{TIMESTAMP_ISO8601}|%{SYSLOGTIMESTAMP})"
negate => true
what => previous
}
}
}
```

```
filter {
if [type] == "error_log" {
grok {
patterns_dir => "/etc/logstash/pattern.d"
match => {"message" => "%{ERROR_LOG}"}
}
}
}
```

`ERROR_LOG <%{NONNEGINT:prifacil}>(%{TIMESTAMP_ISO8601}|%{SYSLOGTIMESTAMP} %{DATA:src_host}) \(%{WORD:source_application}\)`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.