# Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in logstash.err

**URL:** <https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010>\
**Category:** Logstash\
**Created:** [January 25, 2016, 10:30am UTC](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010 "2016-01-25T10:30:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sergey.k](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sergey.k/32/23153_2.png) [@Sergey.k](https://discuss.elastic.co/u/Sergey.k)\
**Post date:** [January 25, 2016, 10:30am UTC](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010/1 "2016-01-25T10:30:15Z")

</div>

HI.  
I have a exceptions in logstash.err file

```
Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in thread "Thread-482"

```

This topic is similar to [Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in thread - logstash.err](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-thread-logstash-err/33618)

But multiline disable not helped to me.

Configs:

/etc/logstash/conf.d/01-lumberjack-input.conf

```
input {
  lumberjack {
    port => 5000
    type => "logs"
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
  http {
      port => 8081
      type => clientlog
      codec => "json"
  }
}

```

/etc/logstash/conf.d/10-syslog.conf

```
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

```

/etc/logstash/conf.d/11-nginx.conf

```
filter {
  if [type] == "nginx-access" {
    grok {
      match => { "message" => "%{NGINXACCESS}" }
    }
  }
}

```

/etc/logstash/conf.d/12-tomcat.conf

```
filter {
  if [type] == "tomcat" {
    multiline {
      pattern => "(^%{TOMCAT_DATESTAMP}|^%{CATALINA_DATESTAMP})"
      negate => true
      what => "previous"
    }
    grok {
           match => { "message" => "(?m)%{TOMCAT_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
      }
    if "_grokparsefailure" in [tags] {
        grok {
            match => { "message" => "(?m)%{CATALINA_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
            remove_tag => ["_grokparsefailure"]
        }
    }
    mutate {
      replace => ["message", "%{content}"]
      remove_field => ["content"]
      add_field => { "uuid" => "%{@timestamp}%{host}%{message}" }
      }
    anonymize {
        algorithm => "SHA256"
        fields => ["uuid"]
        key => "colorbar"
    }
    throttle {
        before_count => -1
        after_count => 1
        period => 86400
        key => "%{host}%{message}"
        add_tag => "throttled"
    }
    if [message] =~ /exception/ or [message] =~ /Exception/ or [message] =~ /EXCEPTION/ {
        mutate {
            add_tag => "exception"
        }
    }
}
}

```

/etc/logstash/conf.d/13-tomcat.conf

```
filter {
  if [type] == "tomcatn" {
    multiline {
      pattern => "------------------------------------------------------------"
      negate => true
      what => "previous"
    }
    grok {
           match => { "message" => "(?m)%{TOMCAT_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
      }
    if "_grokparsefailure" in [tags] {
        grok {
            match => { "message" => "(?m)%{CATALINA_DATESTAMP:tim} %{GREEDYDATA:content:raw}" }
            remove_tag => ["_grokparsefailure"]
        }
    }
    if "_grokparsefailure" in [tags] {
        drop { }
    }
    mutate {
      replace => ["message", "%{content}"]
      remove_field => ["content"]
      add_field => { "uuid" => "%{@timestamp}%{host}%{message}" }
      }
    anonymize {
        algorithm => "SHA256"
        fields => ["uuid"]
        key => "colorbar"
    }
    throttle {
        before_count => -1
        after_count => 1
        period => 86400
        key => "%{host}%{message}"
        add_tag => "throttled"
    }
    if [message] =~ /ERROR.*exception/ or [message] =~ /ERROR.*Exception/ or [message] =~ /ERROR.*EXCEPTION/ {
        mutate {
            add_tag => "exception"
        }
    }
}
}

```

/etc/logstash/conf.d/30-lumberjack-output.conf

```
output {
  if "throttled" not in [tags] {
      if "exception" in [tags] {
      email {
        from => "noreply@mail.com"
        subject => "Exception on %{host} id: %{uuid}"
        to => "support@mail.com"
        body => "Exception on %{host}:\n\n%{message}"
      }
      }
    }
  elasticsearch { host => localhost }
    exec {
                  command => "touch /var/run/logstash-heartbeat"
         }
}

```

logstash 1.5.4  
Linux log 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u1 x86\_64 GNU/Linux

java version "1.8.0\_45"  
Java(TM) SE Runtime Environment (build 1.8.0\_45-b14)  
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010/2 "2017-07-06T05:14:31Z")

</div>