# Logstash crashes when receiving a bad message

**URL:** https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050
**Category:** Logstash
**Created:** [December 5, 2016, 1:45pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050 "2016-12-05T13:45:46Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![graham.dalessandro](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)
#### Post date: [December 5, 2016, 1:45pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/1 "2016-12-05T13:45:46Z")

</div>

Hello Fellow Logstashians,

I am working on exporting Dynatrace data to SPLUNK via logstash. I am using the Dynatrace Real Time Business Transaction Feed and 2 instances of logstash with a redis queue in between. Every night, between 1am and 3am, the Logstash instance that receives the initial message from Dynatrace is being sent a message that causes it to crash with the following error.

## 2016-12-04 01:51:05 -0500: HTTP parse error, malformed request (): #\<Puma::HttpParserError: Invalid HTTP format, parsing fails.\> 2016-12-04 01:51:05 -0500: ENV: {"rack.version"=\>[1, 3], "rack.errors"=\>#\<IO:fd 2\>, "rack.multithread"=\>true, "rack.multiprocess"=\>false, "rack.run\_once"=\>false, "SCRIPT\_NAME"=\>"", "QUERY\_STRING"=\>"", "SERVER\_PROTOCOL"=\>"HTTP/1.1", "SERVER\_SOFTWARE"=\>"2.16.0", "GATEWAY\_INTERFACE"=\>"CGI/1.2", "REQUEST\_METHOD"=\>"GET"}

LogStash::ConfigurationError: Only String and Array types are splittable. field:businessTransactions is of type = NilClass  
filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-split-2.0.5/lib/logstash/filters/split.rb:49  
multi\_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/filters/base.rb:151  
each at org/jruby/RubyArray.java:1613  
multi\_filter at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/filters/base.rb:148  
initialize at (eval):902  
each at org/jruby/RubyArray.java:1613  
initialize at (eval):898  
call at org/jruby/RubyProc.java:281  
filter\_func at (eval):401  
filter\_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267  
each at org/jruby/RubyArray.java:1613  
inject at org/jruby/RubyEnumerable.java:852  
filter\_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265  
worker\_loop at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223  
start\_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201

I have seen many different posts about similar issue and most of them end with a fix being applied to an earlier version of Logstash. I am running 2.4.

---

<div class="post-metadata">

### Author: ![graham.dalessandro](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)
#### Post date: [December 5, 2016, 1:51pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/2 "2016-12-05T13:51:43Z")

</div>

Also, this same setup runs for many many hours before receiving this death message.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2016, 1:59pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/3 "2016-12-05T13:59:14Z")

</div>

You haven't showed us your configuration but it seems you should wrap your split filter in a

```
if [businessTransactions] { ... }

```

conditional.

---

<div class="post-metadata">

### Author: ![graham.dalessandro](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)
#### Post date: [December 5, 2016, 9:49pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/4 "2016-12-05T21:49:57Z")

</div>

Sorry, here is the piece of my configuration that is throwing the error. I believe it already has what you are suggesting:

if !("splitted\_bts" in [tags] and [businessTransactions]) {  
json {  
source =\> "message"  
}  
split {  
field =\> "businessTransactions"  
add\_tag =\> ["splitted\_bts"]  
}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 6, 2016, 6:37am UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/5 "2016-12-06T06:37:12Z")

</div>

No, you have a negation in your conditional. The json and split filters will process the event if there's no `splitted_bts` tag _or_ `businessTransactions` is _not_ set.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2017, 6:37am UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050/6 "2017-01-03T06:37:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.