# Logstash v5.6.3 won't start if debug logging is on

**URL:** <https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817>\
**Category:** Logstash\
**Created:** [October 13, 2017, 4:16am UTC](https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817 "2017-10-13T04:16:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sgladkovich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sgladkovich/32/23027_2.png) [@sgladkovich](https://discuss.elastic.co/u/sgladkovich)\
**Post date:** [October 13, 2017, 4:16am UTC](https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817/1 "2017-10-13T04:16:12Z")

</div>

Hello,

I am running Logstash on Ubuntu 14.04 in AWS. Here are my config details:

```auto
$ grep -E -v '^#|^$' /etc/logstash/logstash.yml
node.name: logstash
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
config.debug: true
log.level: debug
path.logs: /var/log/logstash
$
$ cat /etc/logstash/conf.d/*.conf
#
# This file is managed by Ansible - do not edit.
#
input {
  beats {
    port => 5044
  }
}
#
# This file is managed by Ansible - do not edit.
#
input {
  syslog {
    port => 5000
    type => syslog
  }
}
#
# This file is managed by Ansible - do not edit.
#
filter {
  if [type] == "syslog" {  
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}
#
# This file is managed by Ansible - do not edit.
#
output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "%{[@metadata][type]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
    template_overwrite => "true"
  }
}
$

```

There are no backup files in /etc/logstash/conf.d. When I start Logstash I get these messages in /var/log/logstash/logstash-plain.log:

```auto
[2017-10-13T04:01:14,484][INFO][logstash.pipeline] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
[2017-10-13T04:01:14,495][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"undefined method `to_hash' for []:Array", "backtrace"=>["(eval):70:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
[2017-10-13T04:01:14,505][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"undefined method `to_hash' for []:Array", "backtrace"=>["(eval):70:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
[2017-10-13T04:01:14,511][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"undefined method `to_hash' for []:Array", "backtrace"=>["(eval):70:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
[2017-10-13T04:01:14,516][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>"undefined method `to_hash' for []:Array", "backtrace"=>["(eval):70:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
[2017-10-13T04:01:14,567][FATAL][logstash.runner] An unexpected error occurred! {:error=>#<NoMethodError: undefined method `to_hash' for []:Array>, :backtrace=>["(eval):70:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}

```

and then Logstash dies. This started happening after I upgraded from v5.6.2 to v5.6.3.

Please note, if I _disable debug logging_ like so (in /etc/logstash/logstash.yml):

```auto
config.debug: false
log.level: info

```

then Logstash starts without issues.

Any insight would be highly appreciated.

Thank you,  
Sergey

---

<div class="post-metadata">

**Author:** ![MustDie95](https://avatars.discourse-cdn.com/v4/letter/m/0ea827/32.png) [@MustDie95](https://discuss.elastic.co/u/MustDie95)\
**Post date:** [October 13, 2017, 8:05am UTC](https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817/2 "2017-10-13T08:05:48Z")

</div>

Sergey, I had similar issue. After doing some investigation and searching I have found the "Release notes" for this Logstash version and... - "Known Issue: Running Logstash with log level set to debug will cause the pipeline to crash"  
Downgraded to previous version (5.6.2) and it works well.

---

<div class="post-metadata">

**Author:** ![sgladkovich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sgladkovich/32/23027_2.png) [@sgladkovich](https://discuss.elastic.co/u/sgladkovich)\
**Post date:** [October 13, 2017, 8:12am UTC](https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817/3 "2017-10-13T08:12:55Z")

</div>

Pavel, thank you so much for the information. Sounds like a bug Elastic needs to fix.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2017, 8:12am UTC](https://discuss.elastic.co/t/logstash-v5-6-3-wont-start-if-debug-logging-is-on/103817/4 "2017-11-10T08:12:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.