# Logstash 8.12.2 restart many times may encounter string index out of range -1 error

**URL:** <https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849>\
**Category:** Community Ecosystem\
**Tags:** timelion\
**Created:** [April 5, 2024, 8:35am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849 "2024-04-05T08:35:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\
**Post date:** [April 5, 2024, 8:35am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/1 "2024-04-05T08:35:27Z")

</div>

Hi , last time I restart the logstash 8.12.2 many times (5 - 10 +) may encounter the plugin load errror, so I change mutate { rename =\> {"[host][name]" =\> "[host]"} } to mutate { remove\_field =\> ["host"] } and there's no plugin laod error, but this time I restarted it again for about (5 -10 + times) it has the startup error of string index out of range -1 error ,can any body help me on this? Thanks a lot.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 6, 2024, 7:48am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/2 "2024-04-06T07:48:38Z")

</div>

If you want help on this I think you need to show the full error together with some contect and ideally also your config that results in the error.

---

<div class="post-metadata">

**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\
**Post date:** [April 8, 2024, 9:49am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/3 "2024-04-08T09:49:19Z")

</div>

I want to know why when I upgrade it to 8.12.2 the log comes out the error "Adding pattern {“CISCO\_REASON” =\> “Duplicate TCP SYN” | Failed to locate egress interface | Invalid transport field | No matching connection | DNS Response | DNS Query | (?:%{WORD}\s\*)" I can gurantee that none of the log files contains this fk content

---

<div class="post-metadata">

**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\
**Post date:** [April 8, 2024, 9:53am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/5 "2024-04-08T09:53:06Z")

</div>

and each time the logstash comes out the index out of range -1 the CISCO error comes out

---

<div class="post-metadata">

**Author:** ![LiYuzhuo2020](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liyuzhuo2020/32/132541_2.png) [@LiYuzhuo2020](https://discuss.elastic.co/u/LiYuzhuo2020)\
**Post date:** [April 9, 2024, 10:11am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/6 "2024-04-09T10:11:56Z")

</div>

I need to say sorry to all of you, the root cause is that I didn't stop the logstash properly

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2024, 10:12am UTC](https://discuss.elastic.co/t/logstash-8-12-2-restart-many-times-may-encounter-string-index-out-of-range-1-error/356849/7 "2024-05-07T10:12:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
