# Log4j plugin java.lang.NullPointerException

**URL:** <https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763>\
**Category:** Logstash\
**Created:** [June 3, 2016, 7:09am UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763 "2016-06-03T07:09:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![daytimemoon](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@daytimemoon](https://discuss.elastic.co/u/daytimemoon)\
**Post date:** [June 3, 2016, 7:09am UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763/1 "2016-06-03T07:09:32Z")

</div>

I'm using ELK 2.3.3,logstash 2.3.2 . When I'm trying to use log4j as input,logstash reports java.lang.NullPointerException.  
here is my logstash config:

> ```
> input {
> log4j {
> type => "log4j-type"
> port => 4560
> }
> }
> output {
> elasticsearch {
> index => "logstash-%{type}-%{+YYYY.MM.dd}"
> hosts => ["192.168.10.203:9200"]
> }
> }
> 
> ```

log4j.properties:

> ```
> log4j.rootLogger=INFO,console
> 
> ```

> ```
> # for package com.demo.elk, log would be sent to socket appender.
> log4j.logger.com.demo.elk=DEBUG, socket
> 
> ```

> ```
> # appender socket
> log4j.appender.socket=org.apache.log4j.net.SocketAppender
> log4j.appender.socket.Port=4560
> log4j.appender.socket.RemoteHost=bg1
> log4j.appender.socket.layout=org.apache.log4j.PatternLayout
> log4j.appender.socket.layout.ConversionPattern=%d [%-5p] [%l] %m%n
> log4j.appender.socket.ReconnectionDelay=10000
> 
> ```

> ```
> # appender console
> log4j.appender.console=org.apache.log4j.ConsoleAppender
> log4j.appender.console.target=System.out
> log4j.appender.console.layout=org.apache.log4j.PatternLayout
> log4j.appender.console.layout.ConversionPattern=%d [%-5p] [%l] %m%n
> 
> ```

logstash printed this when I ran my project:

> Closing connection {:client=\>"192.168.22.27:54256", :exception=\>java.lang.NullPointerException, :level=\>:debug, :file=\>"logstash/inputs/log4j.rb", :line=\>"111", :method=\>"handle\_socket"}

---

<div class="post-metadata">

**Author:** ![purbon](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@purbon](https://discuss.elastic.co/u/purbon)\
**Post date:** [June 3, 2016, 1:03pm UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763/2 "2016-06-03T13:03:11Z")

</div>

What this actually means, I admit error is not really clear is that something went wrong during the operation that handles the connections with your log4j appender, socket got closed because of any reason. It would be nice to get a more complete exception, can you provide this somehow?

You configuration+log4j looks good to me, looking forward to know more about your platform and workflow that might help out reproducing this.

---

<div class="post-metadata">

**Author:** ![daytimemoon](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@daytimemoon](https://discuss.elastic.co/u/daytimemoon)\
**Post date:** [June 6, 2016, 1:29am UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763/3 "2016-06-06T01:29:40Z")

</div>

Thanks for your reply!  
I've checked my java code it seemed like no error and printed the right message .

```
import org.apache.log4j.Logger;
public class LogstashTest {
    static Logger log = Logger.getLogger(LogstashTest.class.getName());

    public static void main(String[] args) {
        log.debug("Hello");
        log.info("Hello");
        log.error("Hello");
    }
} 

```

> 2016-06-06 09:18:45,802 [INFO] [LogstashTest.main(LogstashTest.java:8)] Hello  
> 2016-06-06 09:18:45,805 [ERROR] [LogstashTest.main(LogstashTest.java:9)] Hello

> Process finished with exit code 0

BUT when I run logstash using `./logstash -f ../config/log4j.conf --debug` ,the terminal printed these  
messages:

```
Plugin not defined in namespace, checking for plugin file {:type=>"input", :name=>"log4j", :path=>"logstash/inputs/log4j", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"76", :method=>"lookup"}
Plugin not defined in namespace, checking for plugin file {:type=>"codec", :name=>"plain", :path=>"logstash/codecs/plain", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"76", :method=>"lookup"}
......
log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
......
Accepted connection {:client=>"192.168.22.27:64403", :server=>"0.0.0.0:4560", :level=>:debug, :file=>"logstash/inputs/log4j.rb", :line=>"158", :method=>"run"}
Closing connection {:client=>"192.168.22.27:64403", :exception=>java.lang.NullPointerException, :level=>:debug, :file=>"logstash/inputs/log4j.rb", :line=>"111", :method=>"handle_socket"}

```

the server where I ran logstash is Linux version 2.6.32-358.el6.x86\_64

---

<div class="post-metadata">

**Author:** ![bisht\_1991](https://avatars.discourse-cdn.com/v4/letter/b/45deac/32.png) [@bisht\_1991](https://discuss.elastic.co/u/bisht_1991)\
**Post date:** [March 17, 2017, 1:48pm UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763/4 "2017-03-17T13:48:22Z")

</div>

Getting same error. Is it resolved ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763/5 "2017-07-06T04:27:47Z")

</div>