Logstash avro error can't start

Elastic Stack Logstash
1

logstash 7.0.1

[2019-05-07T15:51:16,703][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<ArgumentError: negative length -17 given>, :backtrace=>["org/jruby/ext/stringio/StringIO.java:852:in `read'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:106:in `read'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:93:in `read_bytes'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:99:in `read_string'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:299:in `read_data'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:384:in `block in read_record'", "org/jruby/RubyArray.java:1792:in `each'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:382:in `read_record'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:310:in `read_data'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:275:in `read'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-codec-avro-3.2.3-java/lib/logstash/codecs/avro.rb:77:in `decode'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-input-kafka-9.0.0/lib/logstash/inputs/kafka.rb:256:in `block in thread_runner'", "/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-input-kafka-9.0.0/lib/logstash/inputs/kafka.rb:255:in `block in thread_runner'"]}
[2019-05-07T15:51:16,706][ERROR][logstash.javapipeline    ] A plugin had an unrecoverable error. Will restart this plugin.
  Pipeline_id:main
  Plugin: <LogStash::Inputs::Kafka value_deserializer_class=>"org.apache.kafka.common.serialization.ByteArrayDeserializer", codec=><LogStash::Codecs::Avro schema_uri=>"/var/logstash/logstash-7.0.1/bin/schema.avsc", tag_on_failure=>false, id=>"d7a1f118-7f16-4900-b3bd-3bcfc3b0e2b5", enable_metric=>true>, auto_offset_reset=>"earliest", group_id=>"httptest4", topics=>["avro-xxx-xxx-xxx"], consumer_threads=>42, key_deserializer_class=>"org.apache.kafka.common.serialization.ByteArrayDeserializer", id=>"daa1ea4806ad68a707114a0faee20547cb12e7ac111b338923f02d9eba58e21f", bootstrap_servers=>"xxx:6667,xxxx:6667,xxxx:6667", enable_metric=>true, auto_commit_interval_ms=>"5000", client_id=>"logstash", enable_auto_commit=>"true", poll_timeout_ms=>100, ssl_endpoint_identification_algorithm=>"https", security_protocol=>"PLAINTEXT", sasl_mechanism=>"GSSAPI", decorate_events=>false>
  Error: negative length -17 given
  Exception: ArgumentError

  Exception: ArgumentError
  Stack: org/jruby/ext/stringio/StringIO.java:852:in `read'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:106:in `read'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:93:in `read_bytes'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:99:in `read_string'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:299:in `read_data'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:384:in `block in read_record'
org/jruby/RubyArray.java:1792:in `each'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:382:in `read_record'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:310:in `read_data'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/avro-1.8.2/lib/avro/io.rb:275:in `read'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-codec-avro-3.2.3-java/lib/logstash/codecs/avro.rb:77:in `decode'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-input-kafka-9.0.0/lib/logstash/inputs/kafka.rb:256:in `block in thread_runner'
/var/logstash/logstash-7.0.1/vendor/bundle/jruby/2.5.0/gems/logstash-input-kafka-9.0.0/lib/logstash/inputs/kafka.rb:255:in `block in thread_runner'
[2019-05-07T15:51:16,776][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
2

Error: negative length -17 given
Exception: ArgumentError

3

the error is

[2019-05-07T16:11:56,166][ERROR][logstash.codecs.avro     ] Avro parse error, original data now in message field {:error=>#<ArgumentError: negative length -17 given>}
4

In Avro a string is encoded as a long, which indicates the length of the string, followed by the UTF-8 bytes of the string. A string length cannot be negative. Your input has ingested data in which a string has a negative length, in this case -17, which is represented in zig-zag encoding by 33 or "!". So whatever is sending data to your input is not using Avro encoding.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.