See earlier unresolved issue https://github.com/elastic/beats/issues/995.
Monitoring scribe thrift RPC calls. Some of the calls could have a large number of log entries structures in an array.
Config:
packetbeat.protocols.thrift:
ports: [1463]
transport_type: framed
protocol_type: binary
send_request: true
string_max_size: 10240
enabled: true
Trace:
2017-09-25T05:22:02Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=222 libbeat.logstash.publish.write_bytes=65129 libbeat.logstash.published_and_acked_events=363 libbeat.publisher.messages_in_worker_queues=376 libbeat.publisher.published_events=376 tcp.dropped_because_of_gaps=1 thrift.unmatched_requests=1 thrift.unmatched_responses=21
2017-09-25T05:22:32Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=588 libbeat.logstash.publish.write_bytes=114641 libbeat.logstash.published_and_acked_events=1199 libbeat.publisher.messages_in_worker_queues=1189 libbeat.publisher.published_events=1189 thrift.unmatched_requests=7 thrift.unmatched_responses=45
2017-09-25T05:23:02Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=222 libbeat.logstash.publish.write_bytes=66187 libbeat.logstash.published_and_acked_events=382 libbeat.publisher.messages_in_worker_queues=402 libbeat.publisher.published_events=402 thrift.unmatched_responses=21
2017-09-25T05:23:32Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=636 libbeat.logstash.publish.write_bytes=123977 libbeat.logstash.published_and_acked_events=1296 libbeat.publisher.messages_in_worker_queues=1279 libbeat.publisher.published_events=1279 thrift.unmatched_requests=2 thrift.unmatched_responses=19
2017-09-25T05:23:56Z ERR ParseThrift exception. Recovering, but please report this: runtime error: index out of range.
2017-09-25T05:23:56Z ERR Stacktrace: goroutine 10 [running]:
runtime/debug.Stack(0xbd68c4, 0x2b, 0xc4230b33c0)
/usr/local/go/src/runtime/debug/stack.go:24 +0x79
github.com/elastic/beats/libbeat/logp.Recover(0xbc4816, 0x15)
/go/src/github.com/elastic/beats/libbeat/logp/log.go:145 +0x138
panic(0xada5c0, 0xc420014090)
/usr/local/go/src/runtime/panic.go:458 +0x243
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readStruct(0xc4200da850, 0xc42181050a, 0xc6, 0x1af6, 0xc4220bcdd0, 0xc7, 0x101, 0xc7)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:607 +0x57f
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).(github.com/elastic/beats/packetbeat/protos/thrift.readStruct)-fm(0xc42181050a, 0xc6, 0x1af6, 0xc4220bcdd0, 0xc7, 0xc421840101, 0xc7)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:681 +0x48
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readListOrSet(0xc4200da850, 0xc42180a013, 0x65bd, 0x7fed, 0x1, 0xc421040e00, 0xc4230b3780, 0x5e8cea)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:494 +0x148
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readList(0xc4200da850, 0xc42180a013, 0x65bd, 0x7fed, 0x20, 0xb27f60, 0xc4200a9401, 0xc421800ae0)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:522 +0x50
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).(github.com/elastic/beats/packetbeat/protos/thrift.readList)-fm(0xc42180a013, 0x65bd, 0x7fed, 0x416c01, 0xc4230b3800, 0x4eb933, 0x3)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:675 +0x48
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readField(0xc4200da850, 0xc423110300, 0xbd7be6, 0x2c)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:715 +0x14f
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).messageParser(0xc4200da850, 0xc423110300, 0x1c48)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:767 +0x1a4
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).Parse(0xc4200da850, 0xc4217fd740, 0xc4218bb878, 0xc4200da801, 0xaf1240, 0xc421040d00, 0x0, 0x0)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:940 +0x1f9
github.com/elastic/beats/packetbeat/protos/tcp.(*TCPStream).addPacket(0xc4230b3b60, 0xc4217fd740, 0xc42126a5a0)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:115 +0x176
github.com/elastic/beats/packetbeat/protos/tcp.(*TCP).Process(0xc4212581e0, 0x0, 0xc42126a5a0, 0xc4217fd740)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:208 +0x3a2
github.com/elastic/beats/packetbeat/decoder.(*Decoder).onTCP(0xc42126a000, 0xc4217fd740)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:317 +0xee
github.com/elastic/beats/packetbeat/decoder.(*Decoder).process(0xc42126a000, 0xc4217fd740, 0x2c, 0x1c48, 0x1180dc0, 0xc42126a000)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:258 +0x222
github.com/elastic/beats/packetbeat/decoder.(*Decoder).OnPacket(0xc42126a000, 0xc421808044, 0x1c48, 0x1c48, 0xc42133ac90)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164 +0x343
github.com/elastic/beats/packetbeat/sniffer.(*SnifferSetup).Run(0xc42118f9e0, 0xc26fe0, 0xc421254210)
/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:381 +0x493
github.com/elastic/beats/packetbeat/beater.(*packetbeat).Run.func2(0xc421254210, 0xc420097400, 0xc421256300)
/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:155 +0x6a
created by github.com/elastic/beats/packetbeat/beater.(*packetbeat).Run
/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:159 +0x1b2