# Logstash failing to connect with Elasticsearch and file input plugin crashes

**URL:** <https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487>\
**Category:** Logstash\
**Created:** [November 24, 2015, 9:10pm UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487 "2015-11-24T21:10:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vanguard\_space](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanguard_space/32/5123_2.png) [@Vanguard\_space](https://discuss.elastic.co/u/Vanguard_space)\
**Post date:** [November 24, 2015, 9:10pm UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/1 "2015-11-24T21:10:26Z")

</div>

I am trying to read a .txt file into Logstash and then grok parse it into ES.

I am encountering this error:

{:timestamp=\>"2015-11-24T20:46:44.957000+0000", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::File type=\>"dailyreport", path=\>["/usr/local/sparkexec/report.txt"], start\_position=\>"end", delimiter=\>"\n"\>\n Error: undefined method `+' for nil:NilClass", :level=\>:error}

Logstash config:

input {  
file{  
type =\> "dailyreport"  
path =\> ["/usr/local/sparkexec/report.txt"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/var/log/logstash/.sincedb"  
}  
}

filter{  
if [type]=="dailyreport"{  
grok{  
match =\> { "message" =\> "%{DATA:lineItem}:%{NUMBER:value}"  
}  
}  
mutate{  
strip =\> ["lineItem"]  
}  
}  
if "\_grokparsefailure" in [tags]{  
drop{}  
}  
}

output {  
elasticsearch {  
host =\> "10.2.1.179"  
protocol =\> "http"  
index =\> "report-%{+YYYY.MM.dd}"  
}  
}

Appreciate any guidance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2015, 9:28pm UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/2 "2015-11-24T21:28:44Z")

</div>

Do you have a complete stacktrace or is that all you get? Which version of Logstash?

> start\_position=\>"end"

Huh, but your configuration says `start_position => "beginning"`? Are you sure you're getting the right configuration (starting Logstash with `--debug` will tell you exactly what Logstash gets from the configuration files).

---

<div class="post-metadata">

**Author:** ![Vanguard\_space](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanguard_space/32/5123_2.png) [@Vanguard\_space](https://discuss.elastic.co/u/Vanguard_space)\
**Post date:** [November 24, 2015, 10:27pm UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/3 "2015-11-24T22:27:42Z")

</div>

The version of Logstash is 1.5.1  
I get the same failure even when I change the start\_position =\> "beginning"

I don't have a complete stack trace as of now.

---

<div class="post-metadata">

**Author:** ![Vanguard\_space](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanguard_space/32/5123_2.png) [@Vanguard\_space](https://discuss.elastic.co/u/Vanguard_space)\
**Post date:** [November 24, 2015, 10:45pm UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/4 "2015-11-24T22:45:03Z")

</div>

Here is the stack trace -

> **[Dropbox - Link not found](https://www.dropbox.com/s/ih3bhqglt9g9vg8/debug.txt?dl=0)**
>
> Dropbox is a free service that lets you bring your photos, docs, and videos anywhere and share them easily. Never email yourself a file again!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 25, 2015, 6:37am UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/5 "2015-11-25T06:37:02Z")

</div>

Here we go:

```auto
{:timestamp=>"2015-11-24T22:34:50.766000+0000", :message=>"A plugin had an unrecoverable error. Will restart this plugin.
  Plugin: <LogStash::Inputs::File type=>\"dailyreport\", path=>[\"/usr/local/sparkexec/report.txt\"], start_position=>\"beginning\", delimiter=>\"\
\">
  Error: undefined method `+' for nil:NilClass
  Exception: NoMethodError
  Stack: /opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:183:in `_read_file'
org/jruby/RubyArray.java:1613:in `each'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:181:in `_read_file'
org/jruby/RubyKernel.java:1511:in `loop'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:177:in `_read_file'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:84:in `subscribe'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/watch.rb:90:in `each'
org/jruby/RubyArray.java:1613:in `each'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/watch.rb:75:in `each'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/watch.rb:117:in `subscribe'
/opt/logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.3/lib/filewatch/tail.rb:75:in `subscribe'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-0.1.10/lib/logstash/inputs/file.rb:136:in `run'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:176:in `inputworker'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:170:in `start_input'", :level=>:error, :file=>"logstash/pipeline.rb", :line=>"181", :method=>"inputworker"}

```

This was fixed in Logstash 1.5.2. See [https://github.com/elastic/logstash/issues/3473](https://github.com/elastic/logstash/issues/3473).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487/6 "2017-07-06T05:21:23Z")

</div>