# Logstash - Error at startup - Cannot determine timezone from nil

**URL:** https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533
**Category:** Logstash
**Created:** [May 26, 2025, 9:28am UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533 "2025-05-26T09:28:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@markus](https://discuss.elastic.co/u/markus)
#### Post date: [May 26, 2025, 9:28am UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533/1 "2025-05-26T09:28:53Z")

</div>

Hi,  
I've stumbled upon a problem with my Logstash config. As soon as I use the translate filter Logstash refuses to start.

I use the following minimal config to reproduce the issue:

```auto
input { 
  stdin { } 	
} 

filter {
	mutate {
		add_field => { "foo" => "bar"	}
	}

 translate {
   source => "[foo]"
   target => "[foo_txt]"
   dictionary => {
     "foo" => "bar"
     "foo2" => "bar2"
   }
   fallback => "unkownMapping"
 }
}

output { 
	stdout {} 
}

```

Logstash version is: 8.13.4  
OS is Windows (Server 2025 or Win11)  
Logstash start command:

```auto
logstash -f minimal.conf

```

Timezone settings on my machine with tzutil /g is W. Europe Standard Time

I get the following error (linebreaks added for readability):

```auto
{:action=>LogStash::PipelineAction::Create/pipeline_id:main,
 :exception=>"Java::JavaLang::IllegalStateException",
 :message=>"Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil
 (secs:1748251030.098,utc~:\"2025-05-26 09:17:10.09800004959106445\",ltz~:nil)
 (etz:nil,tnz:\"MESZ\",tziv:\"2.0.6\",tzidv:\"1.2024.1\",rv:\"3.1.4\",rp:\"java\",win:true,rorv:nil,astz:nil,eov:\"1.2.11\",eotnz:\"???\",eotnfz:\"???\",eotlzn:\"???\",
 debian:nil,centos:nil,osx:nil)
 Try setting `ENV['TZ'] = 'Continent/City'` in your script (see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)",
 :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:120)", 
"org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)", 
"org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", 
"org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)", 
"org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1319)", 
"org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:139)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:367)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:128)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", 
"org.jruby.RubyClass.newInstance(RubyClass.java:931)", 
"org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", 
"org.jruby.ir.instructions.CallBase.interpret(CallBase.java:548)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:367)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:88)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:238)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)", 
"org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:228)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:476)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:293)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:328)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", 
"org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)", 
"org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)", 
"org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", 
"org.jruby.runtime.Block.call(Block.java:144)", 
"org.jruby.RubyProc.call(RubyProc.java:352)", 
"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)", 
"java.base/java.lang.Thread.run(Thread.java:840)"]}

```

If I remove the translate filter in the above config everything is working as expected. The error also occurs if I start Logstash to just check the config (with -t flag).

Any idea what is going wrong / what I'm missing?

---

<div class="post-metadata">

### Author: ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [May 26, 2025, 9:40am UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533/2 "2025-05-26T09:40:30Z")

</div>

looks similar to:

> <https://github.com/elastic/logstash/issues/14841>
>
> Logstash 8.6.0 Windows 10 bat, http\_poller 5.4.0
> 
> when using http\_poller in my… conf like so:
> 
> \`\`\`
> input {
> http\_poller {
> urls =\> {
> test1 =\> "remotehost:1234/my\_service/logfile"
> }
> codec =\> "json"
> }
> }
> 
> output {
> stdout {
> codec =\> rubydebug
> }
> }
> \`\`\`
> 
> i get:
> 
> \`\[2023-01-16T16:47:07,654\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil\\n(secs:1673884024.639,utc~:\\"2023-01-16 15:47:04.6389999389648438\\",ltz~:nil)\\n(etz:nil,tnz:\\"MEZ\\",tziv:\\"2.0.5\\",tzidv:\\"1.2022.6\\",rv:\\"2.6.8\\",rp:\\"java\\",win:true,rorv:nil,astz:nil,eov:\\"1.2.7\\",eotnz:\\"???\\",eotnfz:\\"???\\",eotlzn:\\"???\\",\\ndebian:nil,centos:nil,osx:nil)\\nTry setting \`ENV\['TZ'\] = 'Continent/City'\` in your script (see https://en.wikipedia.org/wiki/List\_of\_tz\_database\_time\_zones)", :backtrace=\>\["org.logstash.config.ir.CompiledPipeline.\<init\>(CompiledPipeline.java:120)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:181)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:846)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1229)", "org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:131)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET\_METHOD(MixedModeIRMethod.java:128)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:329)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.RubyClass.newInstance(RubyClass.java:911)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:329)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:87)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:549)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:361)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:92)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET\_METHOD(MixedModeIRMethod.java:238)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:226)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:393)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:206)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:325)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:72)", "org.jruby.ir.interpreter.Interpreter.INTERPRET\_BLOCK(Interpreter.java:116)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:143)", "org.jruby.RubyProc.call(RubyProc.java:309)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:107)", "java.base/java.lang.Thread.run(Thread.java:833)"\]}\`
> 
> Am I doing something wrong? i tried setting the env var in the bat file (set ZT=Europe/Berlin), but it gave me error that my config is wrong. is this a bug maybe?

There:

Setting the **environment variable** TZ resolves this issue.

Have you that environment variable set ? If so, to what? "Europe/Berlin" or similar would seem appropriate.

---

<div class="post-metadata">

### Author: ![markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@markus](https://discuss.elastic.co/u/markus)
#### Post date: [May 27, 2025, 1:39pm UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533/3 "2025-05-27T13:39:12Z")

</div>

Hi,  
thanks for your reply. I failed to related the other posts with this error message to my scenario as they all regarded the JDBC input whereas I'm using the translate filter.

What I don't understand however is that in our production setup Logstash runs as a windows service without the TZ env variable set and that seems to be working fine...

Any idea on why that is?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 27, 2025, 2:57pm UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533/4 "2025-05-27T14:57:16Z")

</div>

> [@markus](#):
>
> :message=\>"Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil  
> (secs:1748251030.098,utc~:"2025-05-26 09:17:10.09800004959106445",ltz~:nil)  
> (etz:nil,tnz:"MESZ"

Mid-european summer time is not one of the [time zone names that Joda understands](https://www.joda.org/joda-time/timezones.html), so, as the error message says, try setting `ENV['TZ'] = 'Continent/City'`. See [this](https://discuss.elastic.co/t/http-poller-timezone-is-not-being-recognized/358980/2) thread.

A translate filter has a schedule (refresh\_interval), so it needs to know what time the next refresh should occur.
