# Logstash Pipeline crash **URL:** \ **Category:** Logstash\ **Created:** [October 17, 2024, 1:08pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001 "2024-10-17T13:08:32Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hunter32](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunter32/32/138468_2.png) [@hunter32](https://discuss.elastic.co/u/hunter32)\ **Post date:** [October 17, 2024, 1:08pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/1 "2024-10-17T13:08:33Z")
We are getting some infrequent crashes with logstash. They seem to always be NoMethodFound errors on test\_for\_inclusion. When it failed no of my error logging is happen so I can not find the location in my pipeline that is causing this [2024-09-27T02:21:12,123][ERROR][logstash.javapipeline][corelight\_ecs] Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"corelight\_ecs", :error=\>"(NoMethodError) undefined method `test\_for\_inclusion' for nil:NilClass", :exception=\>Java::OrgJrubyExceptions::NoMethodError, :backtrace=\>["usr.share.logstash.vendor.bundle.jruby.$3\_dot\_1\_dot\_0.gems.logstash\_minus\_filter\_minus\_translate\_minus\_3\_dot\_4\_dot\_2.lib.logstash.filters.translate.filter(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-filter-translate-3.4.2/lib/logstash/filters/translate.rb:261)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.do\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:158)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:176)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1989)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:173)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.multi\_filter(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133)", "RUBY.start\_workers(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:304)"], :thread=\>"#\"} [2024-09-27T02:21:12,147][WARN][logstash.javapipeline][corelight\_ecs] Waiting for input plugin to close {:pipeline\_id=\>"corelight\_ecs", :thread=\>"#\"} [2024-09-27T02:21:14,012][INFO][logstash.javapipeline][corelight\_ecs] Pipeline terminated {"pipeline.id"=\>"corelight\_ecs"} ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 17, 2024, 1:13pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/2 "2024-10-17T13:13:10Z")
Hello, You need to share your pipeline. ---
**Author:** ![hunter32](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunter32/32/138468_2.png) [@hunter32](https://discuss.elastic.co/u/hunter32)\ **Post date:** [October 17, 2024, 1:32pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/3 "2024-10-17T13:32:25Z")
> [@hunter32](#): > > We are getting some infrequent crashes with logstash. They seem to always be NoMethodFound errors on test\_for\_inclusion. When it failed no of my error logging is happen so I can not find the location in my pipeline that is causing this > > [2024-09-27T02:21:12,123][ERROR][logstash.javapipeline][corelight\_ecs] Pipeline worker error, the pipeline will be stopped {:pipeline\_id=\>"corelight\_ecs", :error=\>"(NoMethodError) undefined method `test\_for\_inclusion' for nil:NilClass", :exception=\>Java::OrgJrubyExceptions::NoMethodError, :backtrace=\>["usr.share.logstash.vendor.bundle.jruby.$3\_dot\_1\_dot\_0.gems.logstash\_minus\_filter\_minus\_translate\_minus\_3\_dot\_4\_dot\_2.lib.logstash.filters.translate.filter(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-filter-translate-3.4.2/lib/logstash/filters/translate.rb:261)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.do\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:158)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:176)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1989)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:173)", "org.logstash.config.ir.compiler.AbstractFilterDelegatorExt.multi\_filter(org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:133)", "RUBY.start\_workers(/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:304)"], :thread=\>"#\"} > > [2024-09-27T02:21:12,147][WARN][logstash.javapipeline][corelight\_ecs] Waiting for input plugin to close {:pipeline\_id=\>"corelight\_ecs", :thread=\>"#\"} > > [2024-09-27T02:21:14,012][INFO][logstash.javapipeline][corelight\_ecs] Pipeline terminated {"pipeline.id"=\>"corelight\_ecs"} Sorry about that here it is > **[GitHub - corelight/ecs-logstash-mappings: Mapping Corelight or Zeek data to Elastic Common...](https://github.com/corelight/ecs-logstash-mappings)** > > Mapping Corelight or Zeek data to Elastic Common Schema logs ---
**Author:** ![hunter32](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunter32/32/138468_2.png) [@hunter32](https://discuss.elastic.co/u/hunter32)\ **Post date:** [October 17, 2024, 4:46pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/4 "2024-10-17T16:46:57Z")
> [@hunter32](#): > > test\_for\_inclusion My working theory is that we are calling translate for a dictionary work in a few pipelines, and that is the only place I can see that the test\_for\_inclusion should be called. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 17, 2024, 5:19pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/5 "2024-10-17T17:19:03Z")
> [@hunter32](#): > > My working theory is that we are calling translate for a dictionary work in a few pipelines No doubt. The stacktrace shows the exception is happening at logstash-filter-translate-3.4.2/lib/logstash/filters/translate.rb:261, which is [here](https://github.com/logstash-plugins/logstash-filter-translate/blob/31d4484de75003180b396a7a86c1afca2c2b30e1/lib/logstash/filters/translate.rb#L261). @updater has instance scope, so each translate filter has a different value for it. It is [initialized](https://github.com/logstash-plugins/logstash-filter-translate/blob/31d4484de75003180b396a7a86c1afca2c2b30e1/lib/logstash/filters/translate.rb#L240) in the filter's register method (called once when the pipeline starts). It should never be nil. If one of those calls to SingleValueUpdate.new failed then I would expect the register call to throw an exception and the pipeline should not start. I cannot think of a way for that exception to happen. ---
**Author:** ![hunter32](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunter32/32/138468_2.png) [@hunter32](https://discuss.elastic.co/u/hunter32)\ **Post date:** [October 17, 2024, 10:20pm UTC](https://discuss.elastic.co/t/logstash-pipeline-crash/369001/6 "2024-10-17T22:20:23Z")
To me, it looks like a Logstash bug, not a pipeline bug.