# Logstasg ERROR filewatch.tailmode.handlers.grow **URL:** \ **Category:** Logstash\ **Created:** [September 30, 2022, 11:42am UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550 "2022-09-30T11:42:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Post date:** [September 30, 2022, 11:42am UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/1 "2022-09-30T11:42:31Z")
Hi, set up reading mysql logs from nfs using multiline codec and grok filter The first problem is that it doesn’t read the file after rotation, restarting doesn’t help, it still doesn’t seem to see it, there was an error with the heap size, it doesn’t seem to appear anymore, jvm config- ```auto -Xms8g -Xmx8g ``` File input config- ```auto input { file { path => "/home/dir/logs/mysql-master_slow.log" codec => multiline { pattern => "^#%{SPACE}Time:%{SPACE}%{TIMESTAMP_ISO8601:time}" negate => true what => "previous" auto_flush_interval => 60 } } } ``` The second problem appeared today ```auto [2022-09-30T09:05:23,550][ERROR][filewatch.tailmode.handlers.grow][slowlog][05f681df29f8ebd8d5df33285b91122f77a58bce1285e132e6aa879d8fa95b63] controlled_read general error reading {:path=>"/home/dir/logs/mysql-master_slow.log", :exception=>Java::JavaLang::NegativeArraySizeException, :message=>"-1796390041"} ``` And there are a lot of such errors, can anyone help? ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [October 1, 2022, 12:03pm UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/2 "2022-10-01T12:03:11Z")
> [@alex\_96](#): > > The first problem is that it doesn’t read the file after rotation Try with this: ```auto file { path => "/home/dir/logs/mysql-master_slow.log" codec => multiline { pattern => "^#%{SPACE}Time:%{SPACE}%{TIMESTAMP_ISO8601}" negate => true what => "previous" auto_flush_interval => 60 } start_position => beginning sincedb_path => ["/path/file-sincedb.db"] mode => "tail" } ``` > [@alex\_96](#): > > `NegativeArraySizeException` _The `NegativeArraySizeException` is a runtime exception in Java that occurs when an application attempts to create an array with a negative size._ Try without **:time** in pattern ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [October 1, 2022, 12:14pm UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/3 "2022-10-01T12:14:31Z")
If still not working, paste few lines from the mysql-master\_slow.log ---
**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Post date:** [October 2, 2022, 1:25pm UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/4 "2022-10-02T13:25:50Z")
Hello, i added this config ```auto start_position => beginning sincedb_path => ["/var/lib/logstash/plugins/inputs/file/.sincedb_ec67afd1dee253d7ccda120a4fa59e62"] mode => "tail" ``` Still I get this error ```auto [FATAL][org.logstash.Logstash] java.lang.OutOfMemoryError: Java heap space ``` After it logstash restarts And a few lines from mysql-master\_slow.log ```auto # Time: 2022-10-01T11:10:17.781340Z # User@Host: user[user] @ [192.168.100.1] Id: 325513 # Query_time: 0.000017 Lock_time: 0.000000 Rows_sent: 0 Rows_examined: 0 SET timestamp=1664742234; SHOW WARNINGS; ``` logstash reads these lines from a file typically around 200GB in size daily ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [October 6, 2022, 8:12am UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/5 "2022-10-06T08:12:57Z")
In case that someone needs... To read multiline mysql-master\_slow.log file use code: ```auto filter { # remove multiline in tags mutate{ remove_field => ["tags"] } # split fields without Query_time line grok { break_on_match => false match => { "message" => "^#%{SPACE}Time:%{SPACE}%{TIMESTAMP_ISO8601:time}%{GREEDYDATA}User@Host:%{SPACE}%{USERNAME:f_name}\[%{DATA:s_name}\]%{SPACE}@%{SPACE}%{DATA:hostname}%{SPACE}\[(%{DATA:ip})?\]%{SPACE}Id:%{SPACE}%{NUMBER:user_id}%{GREEDYDATA}Rows_examined:%{SPACE}%{NUMBER}(\r\n|\r|\n)%{GREEDYDATA:query}"} } # convert to date and save in @timestamp date { match => ["time", "ISO8601"] remove_field => ["time"] timezone => "Europe/Berlin" } # extract fields from queries grok { break_on_match => false tag_on_failure => "_grokqueryfailure" match => { "query" => [ "ua2_.phone='%{DATA:ua2_phone}'", "ua2_.email='%{DATA:ua2_email}'", "%{SPACE}mobile_number='%{DATA:mobile_number}'", "%{SPACE}email='%{DATA:email}'", "%{DATA}" ] } } } ``` Also is possible to read line by line. ```auto grok { break_on_match => false match => { "message" => "^#%{SPACE}Time:%{SPACE}%{TIMESTAMP_ISO8601:time}" } match => { "message" => "^#%{SPACE}User@Host:%{SPACE}%{USERNAME:f_name}\[%{DATA:s_name}\]%{SPACE}@%{SPACE}%{DATA:hostname}%{SPACE}\[(%{DATA:ip})?\]%{SPACE}Id:%{SPACE}%{NUMBER:user_id}" } match => { "message" => "^#%{SPACE}Query_time:%{SPACE}%{BASE16FLOAT:query_time}%{SPACE}Lock_time:%{SPACE}%{BASE16FLOAT:lock_time}%{SPACE}Rows_sent:%{SPACE}%{NUMBER:rows_sent}%{SPACE}Rows_examined:%{SPACE}%{NUMBER:rows_examined}" } match => { "message" => "^(?!#)%{GREEDYDATA:query}"} } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 3, 2022, 8:13am UTC](https://discuss.elastic.co/t/logstasg-error-filewatch-tailmode-handlers-grow/315550/6 "2022-11-03T08:13:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.