# \[Elasticsearch Filter Plugin\] index\_not\_found\_exception java.lang.NullPointerException: null **URL:** \ **Category:** Logstash\ **Created:** [June 2, 2020, 2:58pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358 "2020-06-02T14:58:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Alufolie](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@Alufolie](https://discuss.elastic.co/u/Alufolie)\ **Post date:** [June 2, 2020, 2:58pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358/1 "2020-06-02T14:58:10Z")
Hey Elastic Community, with the turn of May to June we had some issues with our Logstash. To get Data from older documents we use the elasticsearch filter plugin in some of our pipelines. Most of our indices are month based named, so with month turnover a new index will be used. Logstash Filter abstract: ```ruby input { snmp { ... } } filter { elasticsearch { hosts => ["..."] query => "_id:%{portid}" index => "xxx-%{+YYYY.MM}" fields => { ... } } } output { elasticsearch { hosts => ["..."] index => "xxx-%{+YYYY.MM}" action => update doc_as_upsert => true document_id => "%{portid}" } elasticsearch { hosts => ["..."] index => "ed-interfacestats-%{+YYYY.MM}" } } ``` On the 1st of June Logstash throwed the following exception: ```auto [2020-06-01T02:00:00,970][WARN][logstash.filters.elasticsearch] Failed to query elasticsearch for previous event {:index=>"xxx-%{+YYYY.MM}", :error=>"[404] {\"error\":{\"root_cause\": [{\"type\":\"index_not_found_exception\",\"reason\":\"no such index [xxx-2020.06]\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"xxx-2020.06\",\"index_uuid\":\" _na_\",\"index\":\"xxx-2020.06\"}],\"type\":\"index_not_found_exception\",\"reason\":\"no such index [xxx-2020.06]\",\"resource.type\":\"index_or_alias\",\"resource.id\": \"xxx-2020.06\",\"index_uuid\":\"_na_\",\"index\":\"xxx-2020.06\"},\"status\":404}"} [2020-06-01T02:00:00,971][ERROR][org.logstash.execution.WorkerLoop] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logsta sh. java.lang.NullPointerException: null at org.logstash.config.ir.compiler.EventCondition$Compiler$UnexpectedTypeException.(EventCondition.java:659) ~[logstash-core.jar:?] at org.logstash.config.ir.compiler.EventCondition$Compiler.compare(EventCondition.java:433) ~[logstash-core.jar:?] at org.logstash.config.ir.compiler.EventCondition$Compiler.lambda$compareFieldToConstant$11(EventCondition.java:424) ~[logstash-core.jar:?] at org.logstash.config.ir.compiler.Utils.filterEvents(Utils.java:27) ~[logstash-core.jar:?] at org.logstash.generated.CompiledDataset226.compute(Unknown Source) ~[?:?] at org.logstash.generated.CompiledDataset238.compute(Unknown Source) ~[?:?] at org.logstash.generated.CompiledDataset253.compute(Unknown Source) ~[?:?] at org.logstash.generated.CompiledDataset259.compute(Unknown Source) ~[?:?] at org.logstash.generated.CompiledDataset260.compute(Unknown Source) ~[?:?] at org.logstash.generated.CompiledDataset261.compute(Unknown Source) ~[?:?] at org.logstash.execution.WorkerLoop.run(WorkerLoop.java:64) [logstash-core.jar:?] at jdk.internal.reflect.GeneratedMethodAccessor152.invoke(Unknown Source) ~[?:?] at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?] at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?] at org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(JavaMethod.java:441) [jruby-complete-9.2.9.0.jar:?] at org.jruby.javasupport.JavaMethod.invokeDirect(JavaMethod.java:305) [jruby-complete-9.2.9.0.jar:?] at org.jruby.java.invokers.InstanceMethodInvoker.call(InstanceMethodInvoker.java:32) [jruby-complete-9.2.9.0.jar:?] at usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.RUBY$block$start_workers$5(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:262) [jruby-complete-9.2.9.0.j ar:?] at org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:136) [jruby-complete-9.2.9.0.jar:?] at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:77) [jruby-complete-9.2.9.0.jar:?] at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:71) [jruby-complete-9.2.9.0.jar:?] at org.jruby.runtime.Block.call(Block.java:125) [jruby-complete-9.2.9.0.jar:?] at org.jruby.RubyProc.call(RubyProc.java:274) [jruby-complete-9.2.9.0.jar:?] at org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:105) [jruby-complete-9.2.9.0.jar:?] at java.lang.Thread.run(Thread.java:834) [?:?] [2020-06-01T02:00:01,276][FATAL][logstash.runner] An unexpected error occurred! {:error=>java.lang.IllegalStateException: java.lang.NullPointerException, :backtrace=>["org.logstash.executi on.WorkerLoop.run(org/logstash/execution/WorkerLoop.java:85)", "jdk.internal.reflect.GeneratedMethodAccessor152.invoke(jdk/internal/reflect/GeneratedMethodAccessor152)", "jdk.internal.reflect.Delega tingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.inv okeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:441)", "org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:305)", "usr.share.logstash.logstash_m inus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:262)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:274)", "java.lang.Thread.ru n(java/lang/Thread.java:834)"]} [2020-06-01T02:00:01,601][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit ``` I'm not sure, but in the past this did work without NP exception. The Logstash Service throwed a warning about the missing index and created the new index in the output section. Is there any Elasticsearch Filter Plugin Parameter for Error Handling or did we observe a bug? best regards -Alufolie ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 2, 2020, 3:23pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358/2 "2020-06-02T15:23:34Z")
I believe the NPE is due to a conditional trying to compare a non-existent field with a number. See [here](https://discuss.elastic.co/t/comparing-number-in-conditionnal-event-treatement/217043/5). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 30, 2020, 3:23pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358/3 "2020-06-30T15:23:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.