# Logstash crashing unexpectedly

**URL:** https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188
**Category:** Logstash
**Created:** [June 17, 2016, 8:26pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188 "2016-06-17T20:26:18Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tcouto](https://avatars.discourse-cdn.com/v4/letter/t/9d8465/32.png) [@tcouto](https://discuss.elastic.co/u/tcouto)
#### Post date: [June 17, 2016, 8:26pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/1 "2016-06-17T20:26:18Z")

</div>

Hello, logstash keeps failing and spitting out this error:

```
NoMethodError: undefined method `join' for "_grokparsefailure":String
  receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-gelf-1.0.0/lib/logstash/outputs/gelf.rb:178
  handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/outputs/base.rb:88
  output_func at (eval):47
  outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:244
  start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:166

```

Here's a gist of my logstash configs: [https://gist.github.com/anonymous/0f05229b611b0a9d68592602d78ea32b](https://gist.github.com/anonymous/0f05229b611b0a9d68592602d78ea32b)

We're sending logs from our production app servers to a central VM in our production environment, and from there we forward them to a graylog server in our local environment.  
We have logstash 1.4.2\_modified on the app servers and logstash 1.5.4 on the central 'logshipper' VM.  
Logstash on the central 'logshipper' VM crashes when I add a new input file to the app servers' logstash config and do some grokking and mutating. If I leave this out, logstash doesn't crash.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 20, 2016, 5:43am UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/2 "2016-06-20T05:43:06Z")

</div>

That's odd. The `tags` field should never be a string. That this is allowed might be a bug that's been fixed in more recent versions of Logstash. I'd try upgrading the LS 1.5.4 instance.

---

<div class="post-metadata">

### Author: ![tcouto](https://avatars.discourse-cdn.com/v4/letter/t/9d8465/32.png) [@tcouto](https://discuss.elastic.co/u/tcouto)
#### Post date: [June 22, 2016, 5:25pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/3 "2016-06-22T17:25:38Z")

</div>

Thanks Magnus. I've upgraded the 4 servers on 1.4.2\_modified to 1.5.4, and I'm getting the same error. It usually happens within a few minutes.  
Maybe I should also mention that the 'logshipper' is running on centos 5.7 and the 4 app servers are running on centos 5.10.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 22, 2016, 6:11pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/4 "2016-06-22T18:11:55Z")

</div>

While it's great that you've upgraded the ancient 1.4.2 instances, the problem is most likely introduced on the 1.5.4 which is why I suggested that you upgrade that one.

---

<div class="post-metadata">

### Author: ![tcouto](https://avatars.discourse-cdn.com/v4/letter/t/9d8465/32.png) [@tcouto](https://discuss.elastic.co/u/tcouto)
#### Post date: [June 22, 2016, 6:24pm UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/5 "2016-06-22T18:24:32Z")

</div>

Oh, whoops. I thought you suggested upgrading to 1.5.4

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/logstash-crashing-unexpectedly/53188/6 "2017-07-06T04:51:06Z")

</div>


