Log4j plugin java.lang.NullPointerException

Elastic Stack Logstash
1

I'm using ELK 2.3.3,logstash 2.3.2 . When I'm trying to use log4j as input,logstash reports java.lang.NullPointerException.
here is my logstash config:

input {
  log4j {
    type => "log4j-type"
    port => 4560
  }
}
output {
  elasticsearch {
    index => "logstash-%{type}-%{+YYYY.MM.dd}"
    hosts => ["192.168.10.203:9200"]
  }
}

log4j.properties:

log4j.rootLogger=INFO,console

# for package com.demo.elk, log would be sent to socket appender.
log4j.logger.com.demo.elk=DEBUG, socket

# appender socket
log4j.appender.socket=org.apache.log4j.net.SocketAppender
log4j.appender.socket.Port=4560
log4j.appender.socket.RemoteHost=bg1
log4j.appender.socket.layout=org.apache.log4j.PatternLayout
log4j.appender.socket.layout.ConversionPattern=%d [%-5p] [%l] %m%n
log4j.appender.socket.ReconnectionDelay=10000

# appender console
log4j.appender.console=org.apache.log4j.ConsoleAppender
log4j.appender.console.target=System.out
log4j.appender.console.layout=org.apache.log4j.PatternLayout
log4j.appender.console.layout.ConversionPattern=%d [%-5p] [%l] %m%n

logstash printed this when I ran my project:

Closing connection {:client=>"192.168.22.27:54256", :exception=>java.lang.NullPointerException, :level=>:debug, :file=>"logstash/inputs/log4j.rb", :line=>"111", :method=>"handle_socket"}

2

What this actually means, I admit error is not really clear is that something went wrong during the operation that handles the connections with your log4j appender, socket got closed because of any reason. It would be nice to get a more complete exception, can you provide this somehow?

You configuration+log4j looks good to me, looking forward to know more about your platform and workflow that might help out reproducing this.

3

Thanks for your reply!
I've checked my java code it seemed like no error and printed the right message .

import org.apache.log4j.Logger;
public class LogstashTest {
    static Logger log = Logger.getLogger(LogstashTest.class.getName());

    public static void main(String[] args) {
        log.debug("Hello");
        log.info("Hello");
        log.error("Hello");
    }
}

2016-06-06 09:18:45,802 [INFO ] [LogstashTest.main(LogstashTest.java:8)] Hello
2016-06-06 09:18:45,805 [ERROR] [LogstashTest.main(LogstashTest.java:9)] Hello

Process finished with exit code 0

BUT when I run logstash using ./logstash -f ../config/log4j.conf --debug ,the terminal printed these
messages:

Plugin not defined in namespace, checking for plugin file {:type=>"input", :name=>"log4j", :path=>"logstash/inputs/log4j", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"76", :method=>"lookup"}
Plugin not defined in namespace, checking for plugin file {:type=>"codec", :name=>"plain", :path=>"logstash/codecs/plain", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"76", :method=>"lookup"}
......
log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
......
Accepted connection {:client=>"192.168.22.27:64403", :server=>"0.0.0.0:4560", :level=>:debug, :file=>"logstash/inputs/log4j.rb", :line=>"158", :method=>"run"}
Closing connection {:client=>"192.168.22.27:64403", :exception=>java.lang.NullPointerException, :level=>:debug, :file=>"logstash/inputs/log4j.rb", :line=>"111", :method=>"handle_socket"}

the server where I ran logstash is Linux version 2.6.32-358.el6.x86_64

4

Getting same error. Is it resolved ?