Error with throttle: RuntimeError: can't add a new key into hash during iteration

Elastic Stack Logstash
#1

Hello,

Logstash is stopping due to this error:

logstas.err

Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
RuntimeError: can't add a new key into hash during iteration
            []= at org/jruby/RubyHash.java:992
         filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-throttle-2.0.2/lib/logstash/filters/throttle.rb:186
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:152
           each at org/jruby/RubyArray.java:1613
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:149
  cond_func_529 at (eval):10802
           each at org/jruby/RubyArray.java:1613
  cond_func_529 at (eval):10799
  cond_func_528 at (eval):10817
           each at org/jruby/RubyArray.java:1613
  cond_func_528 at (eval):10814
    filter_func at (eval):1864
   filterworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:219
  start_filters at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:154

the error seems to be with throttle. But i don't know why and what is causing that.

Any suggestion?

Thanks

#2

No idea?
I get this error every morning. IF it helps, i paste my filter configuration file:

}else if [type] and [type] == "tcp" {


	mutate {
		remove_field => [ "host" ]
	}
	grok {
	        patterns_dir => "/etc/logstash/patterns"
	       	match => { "message" => "%{WORD:status}%{SPACE}\|%{SPACE}%{WORD:host}%{SPACE}%{WORD:service}%{SPACE}%{TIMETOMCAT:time}" }
        	}
        date {
                match => [ "time", "YYYY-MM-dd HH:mm:ss"]
                timezone => "Europe/Madrid"
        }
	
	
	if [service] and [service] == "lighttpd" {
		if [status] != "working" {
			mutate {
				replace => { "status" => "not responding" }
                       		}
	
				throttle {
                	        	before_count => 1
	                        	after_count => 1
        	                	period => 900
                	        	key => "%{host}"
                        		add_tag => "lighttpd_error"
		                        }
		
					if "lighttpd_error" not in [tags] {
                        	  		mutate {
	                                	 add_tag => ["email_lighttpd"]
        	        	          	}
                		       }
		}
	} else if [service] and [service] == "mysql" {
		if [status] == "inactive" {

	                throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "mysql_error"
                	        }
	                if "mysql_error" not in [tags] {
        	                  mutate {
                	                add_tag => ["email_mysql"]
					}
                        }

        	}
	} else if [service] and [service] == "mysql_tomcat" {
		
		if [status] == "tomcat_mysql_ok" {
			mutate {
                                replace => { "status" => "working" }
                                }
                                
		} else if [status] == "error_mysql" {
			
			throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "mysql_error"
                	        }
     	           if "mysql_error" not in [tags] {
        	                  mutate {
                	                add_tag => ["email_mysql"]
                        	 }
                	        }

			 mutate {
                                        replace => { "service" => "mysql" }
                                        replace => { "status" => "not responding" }
                       		}

		} else if [status] == "error_tomcat" {

			 throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "tomcat_error"
                	        }
                
				if "tomcat_error" not in [tags] {
		                         mutate {
                	        	        add_tag => ["email_tomcat"]
				  		}
                        	}
			
			 mutate {
                                replace => { "service" => "tomcat" }
                                replace => { "status" => "not responding" }
                                }
                        }
			
		}
}

Errors appeared when i add the part of tcp

#3

Is there a way to know which log leads to this error?
If i knew which error is logstash processing, maybe then i would know why is this happening?

Thanks

#4