# Logstash keep crushing to an uknown reason

**URL:** <https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619>\
**Category:** Logstash\
**Created:** [February 2, 2017, 3:57am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619 "2017-02-02T03:57:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\
**Post date:** [February 2, 2017, 3:57am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619/1 "2017-02-02T03:57:21Z")

</div>

My logstash completely failed and stoped working.I dont think i messed anything up since the configs are back to the same place , service logstash configtest gives a pass.

The error coming out is this :

> {:timestamp=\>"2017-02-02T04:55:39.525000+1100", :message=\>"An unexpected error occurred!", :error=\>#. \<Errno::EINVAL: Invalid argument - Invalid file\>, :class=\>"Errno::EINVAL", :backtrace=\>["org/jruby/RubyIO.java:1807:in `seek'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/geoip-1.6.1/lib/geoip.rb:543:in `detect\_database\_type!'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/geoip-1.6.1/lib/geoip.rb:237:in `initialize'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-geoip-2.0.7/lib/logstash/filters/geoip.rb:102:in `register'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:174:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:174:in `start_workers'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:126:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/agent.rb:210:in `execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/runner.rb:90:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/runner.rb:95:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:in `initialize'"], :level=\>:warn}

Can anyone understand this error?What should be the best course of action to fix this?Please help!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 2, 2017, 6:48am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619/2 "2017-02-02T06:48:08Z")

</div>

Is the geoip database file (GeoLite2-City.mmdb) empty?

---

<div class="post-metadata">

**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\
**Post date:** [February 2, 2017, 7:25am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619/3 "2017-02-02T07:25:25Z")

</div>

Hey magnus thanks for yet another reply of yours.

Frankly speaking i have no idea how to check it so some guidance would be really appriciated.  
Also why would it be emptied all out of a sudden?It's been working just fine for so long.

Thanks in regards.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 2, 2017, 7:30am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619/4 "2017-02-02T07:30:15Z")

</div>

> Frankly speaking i have no idea how to check it so some guidance would be really appriciated.

Locate GeoLite2-City.mmdb in your file system. Check if its size is smaller than 4 bytes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2017, 7:30am UTC](https://discuss.elastic.co/t/logstash-keep-crushing-to-an-uknown-reason/73619/5 "2017-03-02T07:30:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.