Logstash crashes when folder/file it is watching gets deleted and rcreated

Elastic Stack Logstash
1

We have been using logstash 2.3.2 on windows 7 machines to index logs into elastic search. Logstash is configured to watch a folder which has only one file at the time. Using logstash's file input plugin for this purpose. Application writing logs to this folder periodically deletes the whole folder (and the file with in it) and recreates the folder and file. When we start logstash before starting the application (which generates the log), for one iteration things seem to work fine but for next iteration (directory deleted and recreated) logstash crashes with warnings about not able to open the file (which got deleted) followed by following lines

# A fatal error has been detected by the Java Runtime Environment:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00000000029c5c08, pid=10008, tid=8428
#
# JRE version: Java(TM) SE Runtime Environment (8.0_45-b15) (build 1.8.0_45-b15)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.45-b02 mixed mode windows-amd64 compressed oops)
# Problematic frame:
# j com.kenai.jffi.Foreign.invokeArrayO2Int64(JJ[BLjava/lang/Object;IIILjava/lang/Object;III)J+0
#
# Core dump written. Default location: D:\ELK\logstash-2.3.2\hs_err_pid10008.mdmp
#
# An error report file with more information is saved as:
# D:\ELK\logstash-2.3.2\hs_err_pid10008.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.

I searched if somebody had already faced a similar issue and came across following bug already raised
Windows 7 issue when a files is delete in a directory raise a Native Exception. As per this issue is with jruby 1.7.23 and resolved in jruby 1.7.24. Moreover this is present only in logstash 2.X and 2.3.1 whereas I am using 2.3.2.

Other suggestion was to use your own installation of jruby by setting USE_RUBY=1. So I installed latest distribution of jruby and tried this option, but getting error while starting logstash now
"'ruby' is not recognized as an internal or external command, operable program or batch file."

Is there any work around for this.

2

What does your config look like?

3

My conf file is on the following lines

input
{
file
{
path => "D:/log/*.log"
type => "log"
start_position => "end"
ignore_older => 3600
}
}

filter
{
if [type] == "log"
{
csv
{
separator => ","

		columns =>["Field1","Field2","Field3","Field4","Field5",
		"Field6","Field7","Field8","Field9","Field10","Field11","Field12"]

		add_field => { "Field13" => "%{Field2}"
		  "Field14" => "%{Field4}" 
			}
	}
	date 
	{
		match => [ "Field1", "UNIX_MS" ]
		timezone => "Asia/Kolkata"
	}
	
	ruby 
    {
        code => "event['Field15'] = event['Field7'].to_f/1000"
    }
	
	mutate 
	{
		remove_field => [ "Field7"]
	}
}

}

output
{
if [type] == "log"
{
elasticsearch
{
action => "index"
index => "index_test-%{+YYYY.MM.dd}"
hosts => "192.168.137.122:9201"
flush_size => 2000
workers => 4
}
}
}

4

Can you raise an issue here - https://github.com/logstash-plugins/logstash-input-file/issues