# How to trouble shoot logstash crashing

**URL:** https://discuss.elastic.co/t/how-to-trouble-shoot-logstash-crashing/53970
**Category:** Logstash
**Created:** [June 26, 2016, 3:58pm UTC](https://discuss.elastic.co/t/how-to-trouble-shoot-logstash-crashing/53970 "2016-06-26T15:58:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![AyliD](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@AyliD](https://discuss.elastic.co/u/AyliD)
#### Post date: [June 26, 2016, 3:58pm UTC](https://discuss.elastic.co/t/how-to-trouble-shoot-logstash-crashing/53970/1 "2016-06-26T15:58:42Z")

</div>

Hi,

I have 2 nodes that has the same log stash configuration, one of them keep failing on this error:

**TypeError: can't convert nil into String**

**Is there a way for me to understand on what message it failed?On what line in my configuration?**

my Conf file is:

input {  
file {  
path =\> "/opt/Fabrix.TV/logs/manager.log"  
type =\> manager\_vspp\_log  
codec =\> multiline {  
pattern =\> "^%{DATESTAMP:log\_timestamp} "  
negate =\> true  
what =\> previous  
}  
}  
file {  
path =\> "/opt/Fabrix.TV/logs/streamer.log"  
type =\> streamer\_vspp\_log  
codec =\> multiline {  
pattern =\> "^%{DATESTAMP:log\_timestamp} "  
negate =\> true  
what =\> previous  
}  
}  
}

filter {  
environment {  
add\_field =\> { "first\_syspu" =\> "${FIRST\_SYSPU}" }  
add\_field =\> { "drop\_events" =\> "${DROP\_LOGLEVELS}" }  
}  
fingerprint {  
source =\> ["message"]  
target =\> "fingerprint"  
key =\> "78787878"  
method =\> "SHA1"  
concatenate\_sources =\> true  
}  
date {  
match =\> ["log\_timestamp", "MM/dd/YY HH:mm:ss.SSS"]  
}  
if [type] =~ "_vspp\_log" {  
mutate { add\_field =\> { "event\_type" =\> "log" } }  
if [path] =~ "manager.log" {  
grok {  
match =\> { "message" =\> "%{DATESTAMP:log\_timestamp}%{SPACE}%{WORD:loglevel}%{SPACE}(?\<component\_name\>\w\*[_|]\w\*)%{SPACE}%{WORD:message\_type}%{SPACE}%{INT:message\_code}%{SPACE}(?\<session\_id\>(@\w{16})?)%{GREEDYDATA:data}" }  
}  
mutate { update =\> { "component\_name" =\> "vspp\_manager" } }  
} else {  
grok {  
match =\> { "message" =\> "%{DATESTAMP:log\_timestamp}%{SPACE}%{WORD:loglevel}%{SPACE}(?\<component\_name\>\w)%{IP:clientip}%{SPACE}%{WORD:message\_type}%{SPACE}%{INT:message\_code}%{SPACE}(?\<session\_id\>(@\w{16})?)%{GREEDYDATA:data}" }  
}  
if [type] == "streamer" {  
mutate { update =\> { "component\_name" =\> "vspp\_streamer" } }  
}  
}  
mutate {  
convert =\> { "has\_session\_id" =\> "boolean" }  
}  
if [session\_id] =~ "@" {  
mutate { add\_field =\> { "has\_session\_id" =\> true } }  
} else {  
mutate { add\_field =\> { "has\_session\_id" =\> false } }  
}  
translate {  
field =\> "message\_code"  
destination =\> "translated\_message\_code"  
dictionary\_path =\> "/etc/logstash/utils/logstash\_translate.yml"  
}  
mutate {  
convert =\> { "message\_code" =\> "integer" }  
}  
if [message\_code] in [17019, 17023] {  
# Tear Down Message Codes.  
mutate { update =\> { "loglevel" =\> "W" } }  
}  
geoip {  
source =\> "clientip"  
}  
# Setting all events to be dropped unless setted othrwise.  
mutate { add\_field =\> { "drop" =\> false } }  
## Adding simple messages regexes  
if [message\_code] == 0 {  
if [data] =~ /ABR LEVEL %{INT:layer} is out of sync/ {  
mutate { add\_field =\> { "translated\_message\_code" =\> "ABR level is out of sync" } }  
}  
if [data] =~ /Failure in closing file/ {  
mutate { add\_field =\> { "translated\_message\_code" =\> "Failure in closing file" } }  
}  
if [data] =~ /ntp not synchronized or failed getting synchronization state due to/ {  
mutate { add\_field =\> { "translated\_message\_code" =\> "ntp not synchronized" } }  
}  
if [data] =~ /FX\_Packets\_List\_Reader::get\_nibble: empty/ {  
mutate { add\_field =\> { "translated\_message\_code" =\> "FX\_Packets\_List\_Reader::get\_nibble: empty" } }  
}  
if [data] =~ /FX\_HTTP\_Adaptive\_Streaming\_Base\_Service::reply\_err\_ 404/ {  
mutate { add\_field =\> { "translated\_message\_code" =\> "FX\_HTTP\_Adaptive\_Streaming\_Base\_Service::reply\_err\_ 404" } }  
}  
}  
if [loglevel] in [drop\_events] {  
if [message\_code] not in [17302, 17303, 17031, 17018, 17023] {  
# Drop Events if log level should be dropped and message\_code arent in the list above.  
drop{}  
}  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> [\<ELASTIC\_HOSTS\_MACRO\>]  
document\_id =\> "%{fingerprint}"  
}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2016, 5:48am UTC](https://discuss.elastic.co/t/how-to-trouble-shoot-logstash-crashing/53970/2 "2016-06-29T05:48:33Z")

</div>

Are there any more interesting log messages surrounding the one you quoted? What if you crank up the log level with `--debug`? There should be a stack trace somewhere.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/how-to-trouble-shoot-logstash-crashing/53970/3 "2017-07-06T04:50:34Z")

</div>