# Logstash keeps crashing with the same Fatal Error **URL:** \ **Category:** Logstash\ **Created:** [March 7, 2018, 7:09am UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838 "2018-03-07T07:09:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![whicter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whicter/32/28514_2.png) [@whicter](https://discuss.elastic.co/u/whicter)\ **Post date:** [March 7, 2018, 7:09am UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838/1 "2018-03-07T07:09:21Z")
Hello, My logstash keeps crashing with the same reason and I couldn't find the reason. Could someone help? The log is as below: [2018-03-06T17:44:09,393][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=\>["org/jruby/RubyIO.java:1457:in `write'", "org/jruby/RubyIO.java:1428:in`write'", "/scratch/elk/logstash-6.2.2/vendor/bundle/jruby/2.3.0/gems/logstash-output-stdout-3.1.3/lib/logstash/outputs/stdout.rb:44:in `block in multi_receive_encoded'", "org/jruby/RubyArray.java:1734:in`each'", "/scratch/elk/logstash-6.2.2/vendor/bundle/jruby/2.3.0/gems/logstash-output-stdout-3.1.3/lib/logstash/outputs/stdout.rb:43:in `multi_receive_encoded'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/outputs/base.rb:90:in`multi\_receive'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:15:in `block in multi_receive'", "org/jruby/ext/thread/Mutex.java:148:in`synchronize'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:14:in `multi_receive'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/output_delegator.rb:49:in`multi\_receive'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/pipeline.rb:479:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in`each'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/pipeline.rb:478:in `output_batch'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/pipeline.rb:430:in`worker\_loop'", "/scratch/elk/logstash-6.2.2/logstash-core/lib/logstash/pipeline.rb:385:in `block in start\_workers'"]} [2018-03-06T17:44:10,038][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit ~ Thanks ---
**Author:** ![whicter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whicter/32/28514_2.png) [@whicter](https://discuss.elastic.co/u/whicter)\ **Post date:** [March 7, 2018, 6:21pm UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838/2 "2018-03-07T18:21:53Z")
Could someone please help? ---
**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\ **Post date:** [March 7, 2018, 7:12pm UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838/3 "2018-03-07T19:12:40Z")
> [@whicter](#): > > `block in start\_workers' how your conf file looks? ---
**Author:** ![whicter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whicter/32/28514_2.png) [@whicter](https://discuss.elastic.co/u/whicter)\ **Post date:** [March 7, 2018, 7:47pm UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838/4 "2018-03-07T19:47:34Z")
``` Here is my logstash conf file: input { beats { port => "5044" } } filter { grok { match => { "message" => "\A%{IP:ip} - %{PROG:unknown0} \[%{HTTPDATE:http_date}] %{PROG:ecid} %{URIPROTO:http_protocol} %{URIPATHPARAM:uri_path}%{SPACE}%{EMAILLOCALPART:http_version} %{POSINT:http_status} %{PROG:byte_size} \*\*%{SYSLOGPROG:rounded_response_time}/%{SYSLOGPROG:response_time}\*\* %{PROG:place1} %{PROG:userid} %{PROG:unknownid1} - %{PROG:locale}" } match => { "message" => "\A%{IP:ip} - %{PROG:unknown0} \[%{HTTPDATE:http_date}] %{PROG:ecid} %{URIPROTO:http_protocol} %{URIPATHPARAM:uri_path}%{SPACE}%{EMAILLOCALPART:http_version} %{POSINT:http_status} %{PROG:byte_size} \*\*%{SYSLOGPROG:rounded_response_time}/%{SYSLOGPROG:response_time}\*\* %{PROG:place1} %{PROG:userid} - %{PROG:unknownid1} %{PROG:locale}" } match => { "message" => "\A%{IP:ip} - %{PROG:unknown0} \[%{HTTPDATE:http_date}] %{PROG:ecid} %{URIPROTO:http_protocol} %{URIPATHPARAM:uri_path}%{SPACE}%{EMAILLOCALPART:http_version} %{POSINT:http_status} %{PROG:byte_size} \*\*%{SYSLOGPROG:rounded_response_time}/%{SYSLOGPROG:response_time}\*\* %{PROG:place1} %{PROG:userid} %{PROG:unknownid1} %{PROG:locale}" } remove_field => ["program", "prospector", "beat", "tags", "rounded_response_time"] } geoip { source => "ip" } date { match => ["http_date", "dd/MMM/yyyy:HH:mm:ss Z"] target => "@timestamp" } mutate { convert => { "response_time" => "float" } } if [userid] == "-" { ruby { code => "event.set('userid', '')" } } if [locale] == "-" { ruby { code => "event.set('locale', '')" } } if "_grokparsefailure" in [tags] { mutate { add_field => { "parsing_error" => "grokparsefailure" } } } else { ruby { code => "event.set('response_time', event.get('response_time')/1000000)" } } fingerprint { source => "message" target => "[@metadata][fingerprint]" method => "SHA1" key => "Log analytics" base64encode => true } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["rno214009.us.oracle.com:9200"] user => "elastic" password => "elastic" document_id => "%{[@metadata][fingerprint]}" } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2018, 7:47pm UTC](https://discuss.elastic.co/t/logstash-keeps-crashing-with-the-same-fatal-error/122838/5 "2018-04-04T19:47:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.