# Aggregate error

**URL:** <https://discuss.elastic.co/t/aggregate-error/281080>\
**Category:** Logstash\
**Created:** [August 11, 2021, 2:09pm UTC](https://discuss.elastic.co/t/aggregate-error/281080 "2021-08-11T14:09:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Divya\_Bansal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divya_bansal/32/81564_2.png) [@Divya\_Bansal](https://discuss.elastic.co/u/Divya_Bansal)\
**Post date:** [August 11, 2021, 2:09pm UTC](https://discuss.elastic.co/t/aggregate-error/281080/1 "2021-08-11T14:09:58Z")

</div>

Hi,  
**I am using the below filter to parse my log file.**  
if [mesg] == "ERROR" {  
#This is prod tomcat log format  
grok { match =\> { "mesg" =\> ["^\s?[%{DATA:loglevel}] %{TIMESTAMP\_ISO8601:logts} [%{DATA:threadname}] %{DATA:podname} %{DATA:filler1} [%{DATA:classname}] %{GREEDYDATA:fullmesg}"]}}}  
else{  
grok{  
match=\> { "mesg" =\> [  
"^(\s)+(?%{DATA}Exception)[:\s]+(?%{DATA}$)"  
]  
} }  
}  
**The below is the logs that I am parsing** :-  
message":"[ERROR] 2021-08-04T15:27:12.700 [pool-2-thread-44380] linkaadhaarconsumerdeployment-69d9858458-nnzpj - [i.i.i.k.c.l.p.ConsumerProcessor] :: ITDRuntimeException is caught with error code: ITD-EXEC2003 and DevMessage: null and UserMessage: Due to some technical error not able to process.Please check corresponding class ",

"message":"\t and error code ITD-EXEC2003 and stacktrace: ingov.itd.iec.exception.ITDRuntimeException: Due to some technical error not able to process.Please check corresponding class

"message":" and the possible root cause is java.lang.NullPointerException at 1628071038920 with objectarray values as "

"message":"\t and error code ITD-EXEC2003 and stacktrace: java.lang.NullPointerException"

"message":"\tat org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747)"

**It is parsing the logs but also throwing the below mentioned error** :  
[2021-08-11T13:29:58,475][ERROR][logstash.filters.aggregate][main][3a046cd6e4d76d8f3808dd3565ae9ff736047ca3b85c4ff90e5f9259e7e3f0c7] Aggregate exception occurred {:error=\>#\<TypeError: wrong argument type NilClass (expected LogStash::Timestamp)\>, :code=\>"event.set('@timestamp', map['tmplogts'])", :map=\>{}, :event\_data=\>{"exception"=\>"and error code ITD-EXEC2003 and stacktrace: ingov.itd.iec.exception.ITDRuntimeException", "trace"=\>"Due to some technical error not able to process.Please check corresponding class ", "logpath"=\>"_ **", "@timestamp"=\>2021-08-11T07:59:58.106Z, "@metadata"=\>{"path"=\>"D:/new2.log", "host"=\>""}, "host"=\>"", "deployment"=\>"** _"}}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2021, 4:31pm UTC](https://discuss.elastic.co/t/aggregate-error/281080/2 "2021-08-11T16:31:34Z")

</div>

> [@Divya\_Bansal](#):
>
> :error=\>#\<TypeError: wrong argument type NilClass (expected LogStash::Timestamp)\>, :code=\>"event.set('@timestamp', map['tmplogts'])", :map=\>{},

The @timestamp field has to have type LogStash::Timestamp. It seems map['tmplogts'] does not exist, so you are setting to to nil, which causes that exception.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2021, 4:31pm UTC](https://discuss.elastic.co/t/aggregate-error/281080/3 "2021-09-08T16:31:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.