Logstash 5.4.3 crash "Regexp Interrupted error(s)"

[Daniel314 (Daniel C)]

I'm seeing an issue similar to https://github.com/elastic/logstash/issues/5851, except that their problem is with an older version of LogStash.

Here's a sample output I get from Logstash, version 5.4.3 (reformatted slightly for readability):

{"exception"=>"Regexp Interrupted"
,"backtrace"=>["org/jruby/RubyRegexp.java:1657:in =~'" ,"org/jruby/RubyString.java:1729:in=~'"
,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:335:in has_value_splitter?'" ,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:351:inparse'"
,"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-kv-4.0.0/lib/logstash/filters/kv.rb:310:in filter'" ,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:indo_filter'"
,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'" ,"org/jruby/RubyArray.java:1613:ineach'"
,"/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'" ,"/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:43:inmulti_filter'"
,"(eval):27302:in initialize'" ,"org/jruby/RubyArray.java:1613:ineach'"
,"(eval):27298:in initialize'" ,"org/jruby/RubyProc.java:281:incall'"
,"(eval):3643:in filter_func'" ,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:infilter_batch'"
,"org/jruby/RubyProc.java:281:in call'" ,"/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:ineach'"
,"org/jruby/RubyHash.java:1342:in each'" ,"/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:ineach'"
,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in filter_batch'" ,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:inworker_loop'"
,"/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in `start_workers'"]
}

I see this error about once a week. It doesn't always happen in the kv module.
I'm using the Docker image at docker.elastic.co/logstash/logstash:5.4.3 as the basis for my Logstash setup.

Does anyone have any suggestions on trying to troubleshoot this?

Thanks,

[Daniel314 (Daniel C)]

This isn't the only crash I've seen with Logstash 5.4.3. There's also this one

I suspect a bug is being tickled because the Logstash instance never has any idle time (it's reading from a Kafka "firehose" that it can never keep up with).