# Help needed | Issue - panic: runtime error: invalid memory address or nil pointer dereference **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 6, 2017, 8:45pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119 "2017-02-06T20:45:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jatin03k](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jatin03k](https://discuss.elastic.co/u/jatin03k)\ **Post date:** [February 6, 2017, 8:45pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/1 "2017-02-06T20:45:44Z")
Filebeat is failing with above mentioned error when trying to read a standard tomcat error log (stderr.log). I tried to debug the issue by testing with subset, and found that the header might be creating the failure, but after removing the header from the actual file, the issue repeats. Below are the various cases tested. - stderr1.log: Log subset with 2 events & header - Fail - stderr5.log: Only single event with no header or carriage return at the end of event - Success - stderr6.log: 2 events (no header) with preceding and succeeding line feeds - Success - stderr.log: Header removed from original file - Fail The log file is being captured when I feed it to Logstash directly. Not able to attach any of the log or configuration files due to type limitations. Please look into this and suggest. Version 5.1.1 is being used for the complete setup being run on Windows server. Filebeat --\> LogStash --\> ElasticSearch --\> Kibana ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 7, 2017, 1:29am UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/2 "2017-02-07T01:29:10Z")
What operating system? Please provide config, logs, and the stack trace that occurs when it crashes. You can paste them into the message or post them to a [gist](https://gist.github.com) or [pastebin](https://pastebin.com). ---
**Author:** ![jatin03k](https://avatars.discourse-cdn.com/v4/letter/j/df788c/32.png) [@jatin03k](https://discuss.elastic.co/u/jatin03k)\ **Post date:** [February 9, 2017, 7:30am UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/3 "2017-02-09T07:30:28Z")
Hi Andrew, thanks for reply. Please find the link to [gist](https://gist.github.com/anonymous/14f7221ccf062f7e277f7ea15f1ce443) where required artifacts have been pasted. > [@andrewkroh](#): > > What operating system? The Windows server where ELK stack is installed and am also testing filebeat on has Windows Server 2012 R2 Standard operating system. Actual application server where the filebeat is harvesting logs from is also a Windows server. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 9, 2017, 2:13pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/4 "2017-02-09T14:13:43Z")
> [@jatin03k](#): > > ```auto > filebeat.prospectors: > > # Each - is a prospector. Most options can be set at the prospector level, so > # you can use different prospectors for various configurations. > # Below are the prospector specific configurations. > > - input_type: log > > # Paths that should be crawled and fetched. Glob based paths. > paths: > - E:\ELK\IO\FilebeatInput\stderr7.log > > document_type: "TomcatErrTest" > multiline.pattern: ['%{CATALINA_DATESTAMP} '] > multiline.negate: true > multiline.match: after > include_lines: ['%{CATALINA_DATESTAMP} '] > > ``` Filebeat doesn't accept grok patterns. You must specify a single regular expression for `multiline.pattern` (you have a list). And you must also specify a regular expression for include\_lines. Here's a regex example that I think matches your logs. You shouldn't need the `include_lines` option once you have mutliline work properly. ```auto multiline.pattern: ' ^[J|F|M|A|M|S|O|N|D][a-z]{2} [0-9]{1,2}, [0-9]{2}' ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 9, 2017, 4:07pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/5 "2017-02-09T16:07:01Z")
We are also going to investigate the panic that you observed. [https://github.com/elastic/beats/issues/3566](https://github.com/elastic/beats/issues/3566) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2017, 4:08pm UTC](https://discuss.elastic.co/t/help-needed-issue-panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference/74119/6 "2017-03-09T16:08:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.