# Logstash 5.6.4: Fluent parse error, original data now in message field: undefined method merge for nil:NilClass **URL:** \ **Category:** Logstash\ **Created:** [March 5, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-5-6-4-fluent-parse-error-original-data-now-in-message-field-undefined-method-merge-for-nil-nilclass/122442 "2018-03-05T06:33:13Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![patsevanton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patsevanton/32/42692_2.png) [@patsevanton](https://discuss.elastic.co/u/patsevanton)\ **Post date:** [March 5, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-5-6-4-fluent-parse-error-original-data-now-in-message-field-undefined-method-merge-for-nil-nilclass/122442/1 "2018-03-05T06:33:13Z")
Hello everyone! When updating td-agent from 2.3.4 to 2.3.6 logs in elasticsearch ceased to arrive. Logstash swears at > [2018-02-24T19:28:04,478][ERROR][logstash.codecs.fluent] Fluent parse error, original data now in message field {:error=\>#\, :data=\>115} [2018-02-24T19:28:14,374][ERROR][logstash.codecs.fluent] Fluent parse error, original data now in message field {:error=\>#\, :data=\>[37, 114]} The td-agent log says it's sending data. > T XX.XX.XX.XX:54534 -\> YY.YY.YY.YY:24224 [A] > .%ZZZZZZZ.nginx-kkkkkk.pub-access.......Z........remote..DD.DD.DD.DD..host..-..user..-..method..GET..path../static/sign-in.html..code..200..size..1060..referer..-..agent.iMozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36..http\_forwarder\_for..-..request\_time..0.003..response\_time..0.003..upstream\_addr..10.233.46.6:8086..cookie..-.HOSTNAME..SSS-frontend-balancer.original\_time...Z........remote..DD.DD.DD.DD..host..-..user..-..method..GET..path../static/css/data\_face.css..code..200..size..1443..referer.Chttps://kkkkkk-hhh-sss.XXXXXXX.ru/static/sign-in.html..agent.iMozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36..http\_forwarder\_for..-..request\_time..0.018..response\_time..0.018..upstream\_addr..10.233.46.6:8086..cookie..-.HOSTNAME..SSS-frontend-balancer.original\_time...Z........remote..DD.DD.DD.DD..host..-..user..-..method..GET..path../static/images/logo-rp.png..code..200..size..6750..referer.Chttps://kkkkkk-hhh-sss.XXXXXXX.ru/static/sign-in.html..agent.iMozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36..http\_forwarder\_for..-..request\_time..0.017..response\_time..0.017..upstream\_addr..10.233.46.6:8086..cookie..-.HOSTNAME..SSS-frontend-balancer.original\_time...Z........remote..DD.DD.DD.DD..host..-..user..-..method..GET..pa > > T XX.XX.XX.XX:54534 -\> YY.YY.YY.YY:24224 [AFP] > th../static/js/login.js..code..200..size..383..referer.Chttps://kkkkkk-hhh-sss.XXXXXXX.ru/static/sign-in.html..agent.iMozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36..http\_forwarder\_for..-..request\_time..0.003..response\_time..0.003..upstream\_addr..10.233.46.6:8086..cookie..-.HOSTNAME..SSS-frontend-balancer.original\_time. Logstash does not generate errors when using td-agent 2.3.4 **yum list logstash** logstash 5.6.4-1 Any version of td-agent-td-agent generates an error: > plugin/filter\_record\_transformer.rb:242:log\_if\_unknown\_placeholder: unknown placeholder ${@timestamp} found The basic configuration of td-agent > @include conf.d/\*.conf > > \ > @type record\_transformer > > original\_time ${@timestamp} > > \ > @type forward > > host hh.hh.hh.hh port iiiii > heartbeat\_type tcp > buffer\_type file > buffer\_queue\_limit 128 > buffer\_path /var/cache/td-agent/buffer/ > flush\_interval 10s > flush\_at\_shutdown true Config for td-agent for parsing a specific nginx log > \ > type hostname > key\_name HOSTNAME > add\_prefix eeeeeeeeee > type better\_timestamp tag eeeeeeeeee.nginx-lllllll.pub-access type tail path /var/log/nginx/lllllll-access.log pos\_file /var/cache/td-agent/lllllll-nginx-access.pos tag nginx-lllllll-log.access format /^(?[^]_) (?[^]_) (?[^]_) [(?[^]]_)] "(?:(?[^]_)\ +)?(?[^\]_)[^"]_(?: HTTP/[^"]_)?" (?[^]_) ([-]|(?[^]_)) "(?[^"]_)" "(?[^"]_)" "(?[^"]_)"(?: (?[^]_) ([-]|(?[^,]+))(?: ?[,:] ?([-]|(?[^,]+)))?(?: ?[,:] ?([-]|(?[^,]+)))? [.p] ([-]|(?[^,]+))(?: ?[,:] ?([-]|(?[^,]+)))?(?: ?[,:] ?([-]|(?[^,]+)))? "(?[^"]_)")?$/ time\_format %d/%b/%Y:%H:%M:%S %z filter.conf > filter { > > if [original\_time] != "" { > date{ > match =\> ["original\_time" , "ISO8601"] > } > } > > mutate { > rename =\> { > "tags" =\> "tag" > "[beat][hostname]" =\> "HOSTNAME" > } > replace =\> { "[@metadata][indexname]" =\> "%{tag}" } > gsub =\> ["[@metadata][indexname]", "(\[1\].[^.]).(.\*$)", '\1'] > add\_field =\> { > "[post\_environment]" =\> "preprod" > } > remove\_field =\> ['original\_time', '[beat][name]', '[beat][version]', 'input\_type', 'type', 'offset', 'source'] > } > > if [@metadata][indexname] == "\_fluentparsefailure" { > drop { } > } > > } input\_fluentd.conf > input { > tcp { > codec =\> fluent > port =\> 24224 > } > } output\_elasticsearch.conf > output { > elasticsearch { > manage\_template =\> false > hosts =\> ["XX.XX.XX.XX2:9200","XX.XX.XX.XX3:9200","XX.XX.XX.XX4:9200","XX.XX.XX.XX5:9200","XX.XX.XX.XX6:9200"] > index =\> "%{[@metadata][indexname]}-%{+YYYY.MM.dd}" > document\_type =\> "jjjjjjjj\_mapping" > } > } Gemspec add-ons plugins for td-agent 2.3.6 > elasticsearch-5.0.4/elasticsearch.gemspec > elasticsearch-api-5.0.4/elasticsearch-api.gemspec > elasticsearch-transport-5.0.4/elasticsearch-transport.gemspec > excon-0.59.0/excon.gemspec > fluent-mixin-config-placeholders-0.4.0/fluent-mixin-config-placeholders.gemspec > fluent-plugin-better-timestamp-0.1.0/fluent-plugin-better-timestamp.gemspec > fluent-plugin-elasticsearch-1.10.2/fluent-plugin-elasticsearch.gemspec > fluent-plugin-forest-0.3.3/fluent-plugin-forest.gemspec > fluent-plugin-hostname-0.0.2/fluent-plugin-hostname.gemspec > fluent-plugin-tail-multiline-ex-0.0.3/fluent-plugin-tail-multiline-ex.gemspec > fluent-plugin-zabbix-agent-0.2.0/fluent-plugin-zabbix-agent.gemspec > fluentd-0.10.62/fluentd.gemspec > msgpack-0.5.12/msgpack.gemspec > multipart-post-2.0.0/multipart-post.gemspec > zabbix\_protocol-0.1.5/zabbix\_protocol.gemspec * * * 1. ^. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 2, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-5-6-4-fluent-parse-error-original-data-now-in-message-field-undefined-method-merge-for-nil-nilclass/122442/2 "2018-04-02T06:33:15Z")
Closed on April 2, 2018, 6:33am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.