# Error with throttle: RuntimeError: can't add a new key into hash during iteration

**URL:** <https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807>\
**Category:** Logstash\
**Created:** [March 18, 2016, 8:19am UTC](https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807 "2016-03-18T08:19:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\
**Post date:** [March 18, 2016, 8:19am UTC](https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807/1 "2016-03-18T08:19:15Z")

</div>

Hello,

Logstash is stopping due to this error:

**logstas.err**

```
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
Non US-ASCII detected and no charset defined.
Defaulting to UTF-8, set your own if this is incorrect.
RuntimeError: can't add a new key into hash during iteration
            []= at org/jruby/RubyHash.java:992
         filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-throttle-2.0.2/lib/logstash/filters/throttle.rb:186
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:152
           each at org/jruby/RubyArray.java:1613
   multi_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/filters/base.rb:149
  cond_func_529 at (eval):10802
           each at org/jruby/RubyArray.java:1613
  cond_func_529 at (eval):10799
  cond_func_528 at (eval):10817
           each at org/jruby/RubyArray.java:1613
  cond_func_528 at (eval):10814
    filter_func at (eval):1864
   filterworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:219
  start_filters at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:154

```

the error seems to be with throttle. But i don't know why and what is causing that.

Any suggestion?

Thanks

---

<div class="post-metadata">

**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\
**Post date:** [March 23, 2016, 7:53am UTC](https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807/2 "2016-03-23T07:53:22Z")

</div>

No idea?  
I get this error every morning. IF it helps, i paste my filter configuration file:

```
}else if [type] and [type] == "tcp" {

	mutate {
		remove_field => ["host"]
	}
	grok {
	        patterns_dir => "/etc/logstash/patterns"
	       	match => { "message" => "%{WORD:status}%{SPACE}\|%{SPACE}%{WORD:host}%{SPACE}%{WORD:service}%{SPACE}%{TIMETOMCAT:time}" }
        	}
        date {
                match => ["time", "YYYY-MM-dd HH:mm:ss"]
                timezone => "Europe/Madrid"
        }
	
	
	if [service] and [service] == "lighttpd" {
		if [status] != "working" {
			mutate {
				replace => { "status" => "not responding" }
                       		}
	
				throttle {
                	        	before_count => 1
	                        	after_count => 1
        	                	period => 900
                	        	key => "%{host}"
                        		add_tag => "lighttpd_error"
		                        }
		
					if "lighttpd_error" not in [tags] {
                        	  		mutate {
	                                	 add_tag => ["email_lighttpd"]
        	        	          	}
                		       }
		}
	} else if [service] and [service] == "mysql" {
		if [status] == "inactive" {

	                throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "mysql_error"
                	        }
	                if "mysql_error" not in [tags] {
        	                  mutate {
                	                add_tag => ["email_mysql"]
					}
                        }

        	}
	} else if [service] and [service] == "mysql_tomcat" {
		
		if [status] == "tomcat_mysql_ok" {
			mutate {
                                replace => { "status" => "working" }
                                }
                                
		} else if [status] == "error_mysql" {
			
			throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "mysql_error"
                	        }
     	           if "mysql_error" not in [tags] {
        	                  mutate {
                	                add_tag => ["email_mysql"]
                        	 }
                	        }

			 mutate {
                                        replace => { "service" => "mysql" }
                                        replace => { "status" => "not responding" }
                       		}

		} else if [status] == "error_tomcat" {

			 throttle {
        	                before_count => 1
                	        after_count => 1
                        	period => 900
	                        key => "%{host}"
        	                add_tag => "tomcat_error"
                	        }
                
				if "tomcat_error" not in [tags] {
		                         mutate {
                	        	        add_tag => ["email_tomcat"]
				  		}
                        	}
			
			 mutate {
                                replace => { "service" => "tomcat" }
                                replace => { "status" => "not responding" }
                                }
                        }
			
		}
}

```

Errors appeared when i add the part of tcp

---

<div class="post-metadata">

**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\
**Post date:** [April 6, 2016, 9:02am UTC](https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807/3 "2016-04-06T09:02:51Z")

</div>

Is there a way to know which log leads to this error?  
If i knew which error is logstash processing, maybe then i would know why is this happening?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/error-with-throttle-runtimeerror-cant-add-a-new-key-into-hash-during-iteration/44807/4 "2017-07-06T05:03:36Z")

</div>