# Filebeat fails? file.go:84: Fail to convert the event to JSON - reflect.Value.IsNil on zero Value

**URL:** <https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 19, 2016, 12:48am UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877 "2016-03-19T00:48:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dromrell](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@dromrell](https://discuss.elastic.co/u/dromrell)\
**Post date:** [March 19, 2016, 12:48am UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/1 "2016-03-19T00:48:02Z")

</div>

I am trying to ingest some large log files into ELK. Recently setup Filebeat to monitor a watch folder that I drop logs into. This has been working great on my sample data. As I copy over a directory with a days worth of real data the filebeat will process a few hundred thousand lines and then it stops.

I can see that process is still running. I notice the following error in /var/log/messages:

```auto
/usr/bin/filebeat[27070]: file.go:84: Fail to convert the event to JSON: reflect: call of reflect.Value.IsNil on zero Value

```

A 'service filebeat restart' will repair and it continue process logs (but I'm uncertain on if there are gaps). This has failed about half dozen times today and I know this isn't stable enough for what at we need in long term.

My filebeat.yml is relatively simple. Here is the prospector being used:

```auto
filebeat:
  prospectors:
    - 
      paths:
        - /data/filebeat/watch/*/sn.log.*
      fields:
         logsrc-addr: 1.2.3.4
         logsrc-name: name
         logsrc-site: site
         logsrc-cust: tenant
         logsrc-tz: MST
      document_type: logstash_type
      fields_under_root: true
      input_type: log
      exclude_files: [".gz$"]
...

output:
  logstash:
    hosts: ["mylogstashhost:5044"]

  file:
    path: "/data/filebeat/diags"
    number_of_files: 20 
    rotate_every_kb: 10000

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 19, 2016, 4:05pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/2 "2016-03-19T16:05:39Z")

</div>

Interesting. I wonder what that event looks like. Could you compile Filebeat yourself, modifying the "Fail to convert the event to JSON" line in libbeat/outputs/fileout/file.go to this:

```
logp.Err("Fail to convert the event to JSON: %s: %#v", err, event)
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 20, 2016, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/3 "2016-03-20T16:00:43Z")

</div>

first hunch: looks like some bug in the standard library. Definitely worth debugging. This happens regularly?

@dromrell Which filebeat version are you using? Which operating system? the tip by @magnusbaeck is very helpfull. You need any help building filebeat for your OS?

---

<div class="post-metadata">

**Author:** ![dromrell](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@dromrell](https://discuss.elastic.co/u/dromrell)\
**Post date:** [March 21, 2016, 5:15pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/4 "2016-03-21T17:15:52Z")

</div>

I used yum to install the standard packages as explained here:  
[https://www.elastic.co/guide/en/beats/libbeat/current/setup-repositories.html](https://www.elastic.co/guide/en/beats/libbeat/current/setup-repositories.html)  
filebeat version 1.1.1 (amd64)  
CentOS Linux release 7.2.1511 (Core)

I will work on creating the custom build. Any quick tips/links to setup golang build env (starting google search now) or specific versions of filebeat I should modify?

Thanks

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 21, 2016, 10:40pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/5 "2016-03-21T22:40:20Z")

</div>

[golang.org](http://golang.org) has quite helpful docs. See go [getting started guide](https://golang.org/doc/install).

I'd say to test first with main branch if issue (most likely) still persists. You can get nightlies (v 5.0.0 build I think) here (no need to install go dev environment): [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/)

If problem still occurs (most likely) modifications can be done in main branch (grep for json.Unmarshal for possible occurences). I created a [github issue](https://github.com/elastic/beats/issues/1191) for adding error output, but didn't manage to add these yet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-fails-file-go-84-fail-to-convert-the-event-to-json-reflect-value-isnil-on-zero-value/44877/6 "2017-07-05T21:54:22Z")

</div>