Logstash 6.8.3 is crashing 'to_hash_with_metadata'

Hello everyone,

I have 4 identical servers that runs the same deployment of Logstash 6.8.3, one of them, only one crashes with the following error:

[2020-05-21T06:11:31,662][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"undefined method to_hash_with_metadata' for nil:NilClass", "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:273:in block in merge'", "org/jruby/RubyArray.java:1792:in each'", "org/jruby/RubyEnumerable.java:1062:in inject'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:272:in merge'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:230:in previous_filter!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:173:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:in block in multi_filter'", "org/jruby/RubyArray.java:1792:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in multi_filter'", "(eval):35713:in block in initialize'", "org/jruby/RubyArray.java:1792:in each'", "(eval):35710:in block in initialize'", "(eval):5411:in block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start_workers'"], :thread=>"#<Thread:0x37b3ef82 sleep>"}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.