Logstash Error: Unmatched first part of surrogate pair

Hi guys,
Sometimes Logstash fails with this error and Logstash crashes:

[FATAL][logstash.runner] An unexpected error occurred! {:error=>#<IOError: Unmatched first part of surrogate pair (0xd97b) (through reference chain: java.util.HashMap["DATA"]->org.logstash.ConvertedMap["message"]->org.logstash.bivalues.StringBiValue["javaValue()"])>, :backtrace=>["org/logstash/ackedqueue/ext/JrubyAckedQueueExtLibrary.java:150:inwrite'", "/usr/local/logstash/logstash-core/lib/logstash/util/wrapped_acked_queue.rb:56:in push'", "/usr/local/logstash/logstash-core/lib/logstash/util/wrapped_acked_queue.rb:376:inpush'", "/usr/local/logstash/logstash-core/lib/logstash/instrument/wrapped_write_client.rb:22:in push'", "/usr/local/logstash/logstash-core/lib/logstash/instrument/wrapped_write_client.rb:38:inrecord_metric'", "/usr/local/logstash/logstash-core/lib/logstash/instrument/wrapped_write_client.rb:22:in push'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5.1.10/lib/logstash/inputs/kafka.rb:250:inthread_runner'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-3.0.4/lib/logstash/codecs/json.rb:48:in from_json_parse'", "org/jruby/RubyArray.java:1613:ineach'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-3.0.4/lib/logstash/codecs/json.rb:48:in from_json_parse'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-3.0.4/lib/logstash/codecs/json.rb:38:indecode'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5.1.10/lib/logstash/inputs/kafka.rb:241:in thread_runner'", "file:/usr/local/logstash/vendor/jruby/lib/jruby.jar!/jruby/java/java_ext/java.lang.rb:12:ineach'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5.1.10/lib/logstash/inputs/kafka.rb:240:in thread_runner'"]}

Logstash 5.5.3 with Kafka Input and Elasticsearch Output.
OS:
NAME="Red Hat Enterprise Linux Server"
VERSION="7.2 (Maipo)"

Any suggestion?

Thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.