# Logstash exists with unexpected error

**URL:** <https://discuss.elastic.co/t/logstash-exists-with-unexpected-error/178695>\
**Category:** Logstash\
**Created:** [April 26, 2019, 5:04pm UTC](https://discuss.elastic.co/t/logstash-exists-with-unexpected-error/178695 "2019-04-26T17:04:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yangjiajun2014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yangjiajun2014/32/45123_2.png) [@yangjiajun2014](https://discuss.elastic.co/u/yangjiajun2014)\
**Post date:** [April 26, 2019, 5:04pm UTC](https://discuss.elastic.co/t/logstash-exists-with-unexpected-error/178695/1 "2019-04-26T17:04:24Z")

</div>

I use version 5.6.2 and 6.2.3 in my production env.My logstash exists frequently because of fllowing error:

[2019-03-05T08:49:19,668][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<Errno::EMSGSIZE: Message too long - No message available\>, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:438:in `send'", "XXXX/logstash/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-output-udp-3.0.5/lib/logstash/outputs/udp.rb:24:in`block in register'", "XXXX/logstash/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-codec-json-3.0.5/lib/logstash/codecs/json.rb:42:in `encode'", "XXXX/logstash/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-output-udp-3.0.5/lib/logstash/outputs/udp.rb:31:in`receive'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/outputs/base.rb:92:in `block in multi_receive'", "org/jruby/RubyArray.java:1734:in`each'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/outputs/base.rb:92:in `multi_receive'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/output_delegator_strategies/legacy.rb:22:in`multi\_receive'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/output\_delegator.rb:49:in `multi_receive'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:479:in`block in output\_batch'", "org/jruby/RubyHash.java:1343:in `each'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:478:in`output\_batch'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:430:in `worker_loop'", "XXXX/logstash/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:385:in`block in start\_workers'"]}  
[2019-03-05T08:49:19,978][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit

Here is my logstash config :

input {  
beats {  
port =\> 5150  
}  
}

filter {  
truncate {  
fields=\>"message"  
length\_bytes=\>100000  
}  
if ( [type] =~ "XXXX-log"){  
mutate{  
rename =\>{  
"[beat][hostname]" =\> "server\_name"  
}  
}  
grok {  
match =\> ["message", ".\* \w+=(?\<request\_id\>\S+), \w+=(?\S+), \w+=(?\S+), \w+=(?\S+), \w+=(?\S+), \w+=(?\S+), \w+=(?\S+), \w+=(?._)"]  
remove\_field =\> ["beat", "tags", "message", "source", "offset", "prospector"]  
}  
}else if( [type] =~ "nginx-log"){  
mutate{  
rename =\>{  
"[beat][hostname]" =\> "server\_name"  
}   
}  
grok {  
match =\> ["message", "(?\S+) - (?\S+) [(?\S+)] "(?\S+) (?\S+) (?\S+)" (?\d+) (?\d+) "(?._)" "(?\S+)""]  
remove\_field =\> ["offset","prospector","beat","source","tags","message"]  
}  
}else{  
drop {}  
}  
if( [url]=="/" ){  
drop {}  
}  
ruby {  
code =\> "event.timestamp.time.localtime"  
}  
}

output {  
elasticsearch {  
hosts =\> ["XXX1"]  
index =\> "XXXX-%{+YYYY.MM.dd}"  
}  
udp{  
host =\> 'XXX2'  
port =\> 514  
}  
}

Can somebody save me?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 29, 2019, 5:05am UTC](https://discuss.elastic.co/t/logstash-exists-with-unexpected-error/178695/2 "2019-04-29T05:05:02Z")

</div>

It seems like you can have very large messages and UDP has a strict limit, which seems to be causing the problems. I would recommend switching from using the UDP output plugin to TCP or place a conditional around it to check that only short messages (not sure what the limit is) are sent that way.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2019, 5:05am UTC](https://discuss.elastic.co/t/logstash-exists-with-unexpected-error/178695/3 "2019-05-27T05:05:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.