# Logstash 5.4.3 crash "Regexp Interrupted error(s)"

**URL:** <https://discuss.elastic.co/t/logstash-5-4-3-crash-regexp-interrupted-error-s/98757>\
**Category:** Logstash\
**Created:** [August 29, 2017, 9:01pm UTC](https://discuss.elastic.co/t/logstash-5-4-3-crash-regexp-interrupted-error-s/98757 "2017-08-29T21:01:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel314](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel314/32/21668_2.png) [@Daniel314](https://discuss.elastic.co/u/Daniel314)\
**Post date:** [August 29, 2017, 9:01pm UTC](https://discuss.elastic.co/t/logstash-5-4-3-crash-regexp-interrupted-error-s/98757/1 "2017-08-29T21:01:28Z")

</div>

I'm seeing an issue similar to [https://github.com/elastic/logstash/issues/5851](https://github.com/elastic/logstash/issues/5851), except that their problem is with an older version of LogStash.

Here's a sample output I get from Logstash, version 5.4.3 (reformatted slightly for readability):

{"exception"=\>"Regexp Interrupted"  
,"backtrace"=\>["org/jruby/RubyRegexp.java:1657:in =~'" ,"org/jruby/RubyString.java:1729:in=~'"  
,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:335:in has\_value\_splitter?'" ,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:351:inparse'"  
,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:310:in filter'" ,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:indo\_filter'"  
,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi\_filter'" ,"org/jruby/RubyArray.java:1613:ineach'"  
,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi\_filter'" ,"/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:43:inmulti\_filter'"  
,"(eval):27302:in initialize'" ,"org/jruby/RubyArray.java:1613:ineach'"  
,"(eval):27298:in initialize'" ,"org/jruby/RubyProc.java:281:incall'"  
,"(eval):3643:in filter\_func'" ,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:infilter\_batch'"  
,"org/jruby/RubyProc.java:281:in call'" ,"/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:224:ineach'"  
,"org/jruby/RubyHash.java:1342:in each'" ,"/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:223:ineach'"  
,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in filter\_batch'" ,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:inworker\_loop'"  
,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in `start\_workers'"]  
}

I see this error about once a week. It doesn't always happen in the kv module.  
I'm using the Docker image at [docker.elastic.co/logstash/logstash:5.4.3](http://docker.elastic.co/logstash/logstash:5.4.3) as the basis for my Logstash setup.

Does anyone have any suggestions on trying to troubleshoot this?

Thanks,

---

<div class="post-metadata">

**Author:** ![Daniel314](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel314/32/21668_2.png) [@Daniel314](https://discuss.elastic.co/u/Daniel314)\
**Post date:** [August 30, 2017, 1:45pm UTC](https://discuss.elastic.co/t/logstash-5-4-3-crash-regexp-interrupted-error-s/98757/2 "2017-08-30T13:45:29Z")

</div>

This isn't the only crash I've seen with Logstash 5.4.3. There's also [this one](https://discuss.elastic.co/t/logstash-5-4-3-crash-interrupted-waiting-for-mutex-null-in-dns-resolver)

I suspect a bug is being tickled because the Logstash instance never has any idle time (it's reading from a Kafka "firehose" that it can never keep up with).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 1:45pm UTC](https://discuss.elastic.co/t/logstash-5-4-3-crash-regexp-interrupted-error-s/98757/3 "2017-09-27T13:45:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.