# Logstash.pipeline error in dns plugin crashes logstash

**URL:** <https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981>\
**Category:** Logstash\
**Created:** [April 30, 2018, 5:48am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981 "2018-04-30T05:48:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\
**Post date:** [April 30, 2018, 5:48am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/1 "2018-04-30T05:48:59Z")

</div>

Hello. I catch this issue 2nd time: DNS plugin crashes logstash (logstash service stay active, but do nothing untill restart)  
In logstash log there is much errors like

> [ERROR][logstash.filters.dns] DNS: timeout on resolving the hostname.

and one last error, that crashes it:

> [ERROR][logstash.pipeline] \_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.block in retriable\_request(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:255)", "org.jruby.ext.timeout.Timeout.yieldWithTimeout(org/jruby/ext/timeout/Timeout.java:177)", "org.jruby.ext.timeout.Timeout.timeout(org/jruby/ext/timeout/Timeout.java:117)", "org.jruby.ext.timeout.Timeout$INVOKER$s$timeout.call(org/jruby/ext/timeout/Timeout$INVOKER$s$timeout.gen)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther4:timeout(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:254)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.retriable\_request(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:254)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther2:retriable\_request(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:276)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.retriable\_getaddress(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:276)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther0:retriable\_getaddress(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.block in resolve(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.ttl.cache.getset(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/ttl/cache.rb:52)",..........}

Му logstash config:

> filter {

if [fields][log\_file\_type] == "dnslogs"  
{   
csv  
{  
columns =\> ["dns\_request\_time","source\_ip","requested\_domain\_name","dns\_server"]  
}  
mutate  
{  
# gsub =\>["dns\_request\_time", """, ""]  
gsub =\>["source\_ip", ",", ""]  
# gsub =\>["requested\_domain\_name", """, ""]  
# gsub =\>["dns\_server", """, ""]  
# gsub =\>["requested\_domain\_name", """, ""]  
gsub =\>["requested\_domain\_name", ".$", ""]  
}

```
mutate 
{ 
add_field => {"source_hostname" => "%{source_ip}"}
#copy => { "source_ip" => "source_hostname" }
}

date
{
	match => ["dns_request_time","M/d/yyyy h:mm:ss a"]
	target => "@timestamp"
}

mutate
{ 
	add_field => {"local" => "false"}
	#add_field => {"subdomain"=> "nulldomain"}
	#add_field => {"sld"=> "nulldomain"}

}
###
grok {
	patterns_dir => ["/etc/logstash/patterns"]
    match => ["requested_domain_name", "%{HOST:domain}"]
}
tld
{
source => "domain"
target => "target"
}

if [requested_domain_name] =~ /(?i).*\.XXXX$/
or [requested_domain_name] =~ /(?i)^XXXX\.ru$/
or [requested_domain_name] =~ /(?i).*\.XXXX\.ru$/
or [requested_domain_name] =~ /(?i).*\.XXXX-XXXX\.ru$/
or [requested_domain_name] =~ /(?i).*\.XXXX-XXXX\.ru$/
or [requested_domain_name] =~ /(?i).*\.XXXXXXXX\.ru$/
or [requested_domain_name] =~ /(?i).+\.local$/
or [requested_domain_name] =~ /(?i)^\w+$/
{ 
	mutate { replace => { "local" => "true" }}
}

	dns 
{
failed_cache_size => "2000"
failed_cache_ttl => "600"
hit_cache_size => "2000"
hit_cache_ttl => "600"
max_retries => "0"
nameserver => ["192.168.64.253"]
reverse => ["source_hostname"]
action => "replace"
#timeout => 1
}

if [local] != 'true'

```

{   
mutate {  
add\_field =\> {"target\_host" =\> "%{requested\_domain\_name}"}  
add\_field =\> {"maliciousIP" =\> "false"}  
add\_field =\> {"maliciousDomain" =\> "false"}  
}

```
dns 
{
failed_cache_size => "2000"
failed_cache_ttl => "600"
hit_cache_size => "2000"
hit_cache_ttl => "600"
max_retries => "0"
nameserver => ["192.168.64.253"]
resolve => ["target_host"]
action => "replace"
#timeout => 0.7
}
translate {
 field => "[target_host]"
 destination => "maliciousIP"
 dictionary_path => '/etc/logstash/conf.d/ipblacklists/alien.yaml'

```

}  
translate {  
field =\> "[requested\_domain\_name]"  
destination =\> "maliciousDomain"  
dictionary\_path =\> '/etc/logstash/conf.d/domainblacklists/malwaredomains.yaml'  
}  
}

}

}

Whats wrong? logstash 6.2.3

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [May 3, 2018, 1:29am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/2 "2018-05-03T01:29:31Z")

</div>

Are there any other log lines? Typically when `logstash.pipeline` logs an `ERROR`-level message it includes the text of the exception in addition to the backtrace pasted above.

---

<div class="post-metadata">

**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\
**Post date:** [May 3, 2018, 4:25am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/3 "2018-05-03T04:25:15Z")

</div>

Yah, but message is longer than 7k symbols. Ill split it

[2018-05-02T12:13:50,711][DEBUG][logstash.util.decorators] filters/LogStash::Filters::Mutate: adding value to field {"field"=\>"target\_host", "value"=\>["%{requested\_domain\_name}"]}  
[2018-05-02T12:13:50,711][DEBUG][logstash.util.decorators] filters/LogStash::Filters::Mutate: adding value to field {"field"=\>"maliciousIP", "value"=\>["false"]}  
[2018-05-02T12:13:50,711][DEBUG][logstash.util.decorators] filters/LogStash::Filters::Mutate: adding value to field {"field"=\>"maliciousDomain", "value"=\>["false"]}  
[2018-05-02T12:13:50,713][ERROR][logstash.pipeline] dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.block in retriable\_request(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:255)", "org.jruby.ext.timeout.Timeout.yieldWithTimeout(org/jruby/ext/timeout/Timeout.java:177)", "org.jruby.ext.timeout.Timeout.timeout(org/jruby/ext/timeout/Timeout.java:117)", "org.jruby.ext.timeout.Timeout$INVOKER$s$timeout.call(org/jruby/ext/timeout/Timeout$INVOKER$s$timeout.gen)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther4:timeout(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:254)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.retriable\_request(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:254)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther2:retriable\_request(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:276)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.retriable\_getaddress(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:276)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther0:retriable\_getaddress(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.block in resolve(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.ttl.cache.getset(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/ttl/cache.rb:52)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.ttl.cache.RUBY$method$getset$0$ **VARARGS** (usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/lru\_redux\_minus\_1\_dot\_1\_dot\_0/lib/lru\_redux/ttl//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/ttl/cache.rb)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.util.safe\_sync.invokeSuper0:-unknown-super-target-(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/lru\_redux\_minus\_1\_dot\_1\_dot\_0/lib/lru\_redux/util//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/util/safe\_sync.rb:26)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.util.safe\_sync.block in getset(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/util/safe\_sync.rb:26)", "uri\_3a\_classloader\_3a\_.META\_minus\_INF.jruby\_dot\_home.lib.ruby.stdlib.monitor.mon\_synchronize(uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/monitor.rb:214)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.util.safe\_sync.invokeOther2:synchronize(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/lru\_redux\_minus\_1\_dot\_1\_dot\_0/lib/lru\_redux/util//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/util/safe\_sync.rb:25)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.lru\_redux\_minus\_1\_dot\_1\_dot\_0.lib.lru\_redux.util.safe\_sync.getset(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/lru\_redux-1.1.0/lib/lru\_redux/util/safe\_sync.rb:25)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther42:getset(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.block in resolve(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:145)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1734)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther57:each(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:124)",

---

<div class="post-metadata">

**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\
**Post date:** [May 3, 2018, 4:25am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/4 "2018-05-03T04:25:42Z")

</div>

2nd part

"usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.resolve(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:124)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.invokeOther1:resolve(usr/share/logstash/vendor/bundle/jruby/$2\_dot\_3\_dot\_0/gems/logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9/lib/logstash/filters//usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:97)", "usr.share.logstash.vendor.bundle.jruby.$2\_dot\_3\_dot\_0.gems.logstash\_minus\_filter\_minus\_dns\_minus\_3\_dot\_0\_dot\_9.lib.logstash.filters.dns.filter(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-dns-3.0.9/lib/logstash/filters/dns.rb:97)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.invokeOther4:filter(usr/share/logstash/logstash\_minus\_core/lib/logstash/filters//usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.do\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.invokeOther4:do\_filter(usr/share/logstash/logstash\_minus\_core/lib/logstash/filters//usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.block in multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1734)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.invokeOther7:each(usr/share/logstash/logstash\_minus\_core/lib/logstash/filters//usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filters.base.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filter\_delegator.invokeOther10:multi\_filter(usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:47)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.filter\_delegator.multi\_filter(/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:47)", "RUBY.block in initialize((eval):702)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1734)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "RUBY.block in initialize((eval):698)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:289)", "org.jruby.RubyProc.call19(org/jruby/RubyProc.java:273)", "org.jruby.RubyProc$INVOKER$i$0$0$call19.call(org/jruby/RubyProc$INVOKER$i$0$0$call19.gen)", "RUBY.block in initialize((eval):727)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1734)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "RUBY.block in initialize((eval):715)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:289)", "org.jruby.RubyProc.call19(org/jruby/RubyProc.java:273)", "org.jruby.RubyProc$INVOKER$i$0$0$call19.call(org/jruby/RubyProc$INVOKER$i$0$0$call19.gen)", "RUBY.block in filter\_func((eval):420)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:289)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.pipeline.invokeOther3:filter\_func(usr/share/logstash/logstash\_minus\_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:447)", "usr.share.logstash.logstash\_minus\_core.lib.logstash.pipeline.filter\_batch(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:447)", "RUBY.worker\_loop(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426)", "RUBY.block in start\_workers(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:289)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:246)", "java.lang.Thread.run(java/lang/Thread.java:748)"], :thread=\>"#\<Thread:0x1645735f@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:246 sleep\>"}  
[2018-05-02T12:13:50,735][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2018-05-02T12:13:50,735][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}  
[2018-05-02T12:13:55,737][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2018-05-02T12:13:55,737][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}  
[2018-05-02T12:14:00,739][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2018-05-02T12:14:00,739][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}  
[2018-05-02T12:14:05,742][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2018-05-02T12:14:05,742][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}  
[2018-05-02T12:14:10,743][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ParNew"}  
[2018-05-02T12:14:10,743][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=\>"ConcurrentMarkSweep"}

---

<div class="post-metadata">

**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\
**Post date:** [May 7, 2018, 6:36am UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/5 "2018-05-07T06:36:54Z")

</div>

Is this what you mean? Have any Idea?

---

<div class="post-metadata">

**Author:** ![maxf](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@maxf](https://discuss.elastic.co/u/maxf)\
**Post date:** [May 17, 2018, 1:13pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/6 "2018-05-17T13:13:20Z")

</div>

the question is still actual

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [May 18, 2018, 8:45pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/7 "2018-05-18T20:45:08Z")

</div>

Something is getting truncated from your pasted log message, which prevents me from seeing what the exception is.

The line that begins with:

> [@maxf](#):
>
> ```auto
> [2018-05-02T12:13:50,713][ERROR][logstash.pipeline]
> 
> ```

Should have an exception message next; instead, it jumps straight into the middle of a backtrace.

What I can tell though, is that there is some issue with how Timeouts are being handled.

I can also see that 8 days ago a new version of the plugin was released, which addresses some timeout-related issues and performance issues:

> ## 3.0.10
> 
> - Log timeouts as warn instead of error #43
> - Allow concurrent queries when cache enabled #42
> 
> -- [CHANGELOG.md](https://github.com/logstash-plugins/logstash-filter-dns/blob/v3.0.10/CHANGELOG.md#3010)

You can update to the latest version of the plugin [independent](https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html#updating-plugins) of your Logstash version:

```auto
bin/logstash-plugin update logstash-filter-dns

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2018, 8:45pm UTC](https://discuss.elastic.co/t/logstash-pipeline-error-in-dns-plugin-crashes-logstash/129981/8 "2018-06-15T20:45:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.