# Logstash runner unexpected error occured

**URL:** <https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218>\
**Category:** Logstash\
**Created:** [May 22, 2019, 11:48am UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218 "2019-05-22T11:48:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [May 22, 2019, 11:48am UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/1 "2019-05-22T11:48:15Z")

</div>

Hi,

I am trying to parse really large multiline logs, the file is first ingested using filebeat. There i have specified multiline settings so it seems to be fine over ther. However, while ingesting files in logstash an error is thrown:

[2019-05-22T16:41:24,490][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ThreadError: interrupted in Thread::Queue#pop\>, :backtrace=\>["org/jruby/ext/thread/Queue.java:344:in `pop'", "/Users/vivekvardhan.reddy/Applications/logstash/vendor/bundle/jruby/2.5.0/gems/stud-0.0.23/lib/stud/task.rb:38:in`wait'", "/Users/vivekvardhan.reddy/Applications/logstash/logstash-core/lib/logstash/runner.rb:379:in `execute'", "/Users/vivekvardhan.reddy/Applications/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in`run'", "/Users/vivekvardhan.reddy/Applications/logstash/logstash-core/lib/logstash/runner.rb:237:in `run'", "/Users/vivekvardhan.reddy/Applications/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in`run'", "/Users/vivekvardhan.reddy/Applications/logstash/lib/

Here is the part of my config which seems to be the source of issue as when i commented out this code the pipeline was running fine and not throwing this error.

```
if [message] =~ ".*id: nbnplus.*" {
  grok {
    match =>
    {
      message => "%{DATA:thread} %{DATA:sessionid}\s(txid\=%{BASE16NUM})?\s?Time:\s+%{TIME:totaltime}\sid\s?:\s?%{PROG:id}(\[%{DATA:glidefunc}\])?\s?for:\s(?<querybody>(.|\r|\n)*)"
    }
    tag_on_failure => "_nbnplus_grokparsefailure"
  }
  if [totaltime] {
    dissect {
      mapping => {
        "totaltime" => "%{hour}:%{minute}:%{second}.%{millisecond}"
      }
    }
    if [hour] and [minute] and [second] and [millisecond] {
      ruby {
        code => "event.set( 'totaltimeMS', (event.get('hour').to_i*3600*1000 + event.get('minute').to_i*60*10000 + event.get('second').to_i*1000 + event.get('millisecond').to_i))"
      }
      mutate {
        remove_field => ["hour","minute","second","millisecond"]
      }
    }
  }      
}

```

Could anyone please point me in the right direction?

Thanks in advance,  
Vivek

 ![53%20PM%20(2)](https://us1.discourse-cdn.com/elastic/original/3X/6/8/6844e7b17a1e34d9fca834b3e430a5ef0116751f.png) ![57%20PM%20(2)](https://us1.discourse-cdn.com/elastic/original/3X/0/8/086a902b799038bc474de8422af742fbe3a815d0.png)

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [May 22, 2019, 12:00pm UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/2 "2019-05-22T12:00:12Z")

</div>

[INFO] 2019-05-22 13:58:46.465 [LogStash::Runner] runner - Using config.test\_and\_exit mode. Config Validation Result: OK. Exiting Logstash

Tested your config and it is correct when it comes to the syntax.  
Do you have a custom settings for the pipeline and jvm?

---

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [May 22, 2019, 1:43pm UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/3 "2019-05-22T13:43:56Z")

</div>

Greetings Charlie,

The jvm.options file is having the default configuration and coming to logstash.yml I have enabled xpack monitoring so that I can know the ingest rate of my pipeline in Kibana. "pipelines.yml" also has the default configuration

Thanks,  
Vivek

---

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [May 23, 2019, 9:32am UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/4 "2019-05-23T09:32:34Z")

</div>

Hi Could anyone please help me debug this?

---

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [May 27, 2019, 6:45am UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/5 "2019-05-27T06:45:28Z")

</div>

Hi,

This looks like a bug, how do i report it?

Thanks,  
Vivek

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2019, 6:45am UTC](https://discuss.elastic.co/t/logstash-runner-unexpected-error-occured/182218/6 "2019-06-24T06:45:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.