# Java Memory Error From a Ruby Script?

**URL:** <https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [October 9, 2020, 7:44pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611 "2020-10-09T19:44:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [October 9, 2020, 7:44pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611/1 "2020-10-09T19:44:53Z")

</div>

Hi Logstash,

I’m running the Logstash 7.7.0 Docker container, spun up on an Ubuntu machine. In my LS filter config, I “bounce” all of my records off an external C program via a TCP socket:

```
  ruby {
    init => "
      require 'socket'
    "

    code => '
      socket = TCPSocket.new("192.168.3.1", 12345)
      socket.write event.to_hash
      response = socket.recv(10000000)
      event.set("NewData", response)
    '

```

Fairly simple. The C program takes the entire data record, does some processing, and sends back a single string, which should never be more than 50 bytes long. The C program always sends back a string, even under default conditions.

But I’ve noticed that 33% of the time, I see a “null” value in the “NewData” field. That shouldn’t be. Also, I see a lot of this in the LS log:

`[2020-10-09T16:34:10,476][ERROR][logstash.filters.ruby][main][09de6b10cf3fdaa7a5ae8b4e3fcd73837267db580130edc34de5fc2c7e5e9cb2] Ruby exception occurred: Java heap space`

I see this message _ **hundreds** _ of times. I don’t know what it means, but I’m guessing that something in the Ruby code calls Java, Java tries to allocate some memory, and the memory allocation fails. Java throws an exception, which causes Ruby to throw an exception, which causes the above error message. Maybe.

I’ve been rummaging about on the Elastic forum, and it looks like there have been similar-sounding issues to mine, such as [this one](https://discuss.elastic.co/t/java-heapspace-issue-while-running-logstash/234601/3). But the solution quoted here doesn’t seem to apply.

I’m also wondering if the Docker container might be imposing some limitations here? Perhaps a program within a container is only allowed to allocate so much system memory?

How does one troubleshoot something like this? Any suggestions? Much appreciated!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 9, 2020, 8:10pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611/2 "2020-10-09T20:10:43Z")

</div>

Does adding

```
socket.close

```

after the event.set help?

---

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [October 9, 2020, 8:56pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611/3 "2020-10-09T20:56:25Z")

</div>

Ah! Good catch! Thank you!

Unfortunately, modifying the code seems to cause an exception throw on every record. Here's the modified code:

```
code => '
  socket = TCPSocket.new("192.168.3.1", 37261)
  socket.write " "+">>>"+(event.to_hash).to_s+"<<<"
  response = socket.recv(10000000)
  socket.close
  event.set("nDPI_Application", response)
'

```

Did I screw up the `close` function? Because now I don't see a single data record coming into Elasticsearch. The Logstash log is filled with a lot of these:

```
[2020-10-09T20:45:12,347][WARN][logstash.codecs.sflow][main][10cc1a8cf743c5f9a679845029ecff7f06da16648567a2d1e9f51ac125c221be] Invalid sflow packet received (End of file reached)
[2020-10-09T20:45:13,348][WARN][logstash.codecs.sflow][main][10cc1a8cf743c5f9a679845029ecff7f06da16648567a2d1e9f51ac125c221be] Invalid sflow packet received (End of file reached)
[2020-10-09T20:45:15,355][WARN][logstash.codecs.sflow][main][10cc1a8cf743c5f9a679845029ecff7f06da16648567a2d1e9f51ac125c221be] Unknown counter_flow record: entreprise 16, format 0
[2020-10-09T20:45:17,345][WARN][logstash.codecs.sflow][main][10cc1a8cf743c5f9a679845029ecff7f06da16648567a2d1e9f51ac125c221be] Unknown counter_flow record: entreprise 0, format 2203

```

And then _ **hundreds** _ of these:

```
[2020-10-09T20:46:50,364][ERROR][logstash.filters.ruby][main][0778fdc44e50f682f4354179ca25ea3d4ff569db1c408914df2857817ffb24f5] Ruby exception occurred: Java heap space
[2020-10-09T20:46:50,365][ERROR][logstash.filters.ruby][main][0778fdc44e50f682f4354179ca25ea3d4ff569db1c408914df2857817ffb24f5] Ruby exception occurred: Java heap space
[2020-10-09T20:46:50,365][ERROR][logstash.filters.ruby][main][0778fdc44e50f682f4354179ca25ea3d4ff569db1c408914df2857817ffb24f5] Ruby exception occurred: Java heap space
```

---

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [October 13, 2020, 9:25pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611/4 "2020-10-13T21:25:39Z")

</div>

EDIT: Issue went away upon restart... Now the system works perfectly. Wish I knew why, but I'll take it. If anyone from LS sees this, please consider this issue closed. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2020, 9:25pm UTC](https://discuss.elastic.co/t/java-memory-error-from-a-ruby-script/251611/5 "2020-11-10T21:25:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.