multiline filter causing crashes


I've been having some issues getting the multiline filter to be stable over time. It will run ok for a day or two, or even 5 minutes, then crashes with this error:

I can comment out the redis input that is supplying the logs that go through the multiline filter, and then logstash is stable. Here are the relevant entries in my config file:

logstash: 1.2.2
java: 1.7.0_05-b05
ruby: ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]
OS: CentOS 6.2


Jordan Sissel
December 6, 2013, 1:40 AM

I can confirm others are seeing this problem, but for the life of me I can't figure out how to reproduce it :|

Ryan Bellows
December 6, 2013, 1:55 AM

Since filing this and trying to find a workaround, I've split up my previously monolithic logstash indexer into a few separate processes, so any input that uses the multiline filter is separate from others. After that, it's been stable. What happens is the processes that use multiline filter still see the error as originally posted, but restart the logstash process and then continue on. Of two instances that I have running with multiline filters, one has seen the error and restarted around 10 times in the last 2 days, but every time it restarts continues to read from the appropriate redis key and process logs normally.


Richard Pijnenburg


Ryan Bellows

Affects versions