# Packetbeat 5.6.1 - Thrift Protocol Error - index out of range

**URL:** <https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 25, 2017, 5:39am UTC](https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635 "2017-09-25T05:39:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidbernard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidbernard/32/22472_2.png) [@davidbernard](https://discuss.elastic.co/u/davidbernard)\
**Post date:** [September 25, 2017, 5:39am UTC](https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635/1 "2017-09-25T05:39:52Z")

</div>

See earlier unresolved issue [https://github.com/elastic/beats/issues/995](https://github.com/elastic/beats/issues/995).

Monitoring scribe thrift RPC calls. Some of the calls could have a large number of log entries structures in an array.

Config:  
packetbeat.protocols.thrift:  
ports: [1463]  
transport\_type: framed  
protocol\_type: binary  
send\_request: true  
string\_max\_size: 10240  
enabled: true

```
Trace:
2017-09-25T05:22:02Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=222 libbeat.logstash.publish.write_bytes=65129 libbeat.logstash.published_and_acked_events=363 libbeat.publisher.messages_in_worker_queues=376 libbeat.publisher.published_events=376 tcp.dropped_because_of_gaps=1 thrift.unmatched_requests=1 thrift.unmatched_responses=21
2017-09-25T05:22:32Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=588 libbeat.logstash.publish.write_bytes=114641 libbeat.logstash.published_and_acked_events=1199 libbeat.publisher.messages_in_worker_queues=1189 libbeat.publisher.published_events=1189 thrift.unmatched_requests=7 thrift.unmatched_responses=45
2017-09-25T05:23:02Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=222 libbeat.logstash.publish.write_bytes=66187 libbeat.logstash.published_and_acked_events=382 libbeat.publisher.messages_in_worker_queues=402 libbeat.publisher.published_events=402 thrift.unmatched_responses=21
2017-09-25T05:23:32Z INFO Non-zero metrics in the last 30s: libbeat.logstash.call_count.PublishEvents=30 libbeat.logstash.publish.read_bytes=636 libbeat.logstash.publish.write_bytes=123977 libbeat.logstash.published_and_acked_events=1296 libbeat.publisher.messages_in_worker_queues=1279 libbeat.publisher.published_events=1279 thrift.unmatched_requests=2 thrift.unmatched_responses=19
2017-09-25T05:23:56Z ERR ParseThrift exception. Recovering, but please report this: runtime error: index out of range.
2017-09-25T05:23:56Z ERR Stacktrace: goroutine 10 [running]:
runtime/debug.Stack(0xbd68c4, 0x2b, 0xc4230b33c0)
/usr/local/go/src/runtime/debug/stack.go:24 +0x79
github.com/elastic/beats/libbeat/logp.Recover(0xbc4816, 0x15)
/go/src/github.com/elastic/beats/libbeat/logp/log.go:145 +0x138
panic(0xada5c0, 0xc420014090)
/usr/local/go/src/runtime/panic.go:458 +0x243
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readStruct(0xc4200da850, 0xc42181050a, 0xc6, 0x1af6, 0xc4220bcdd0, 0xc7, 0x101, 0xc7)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:607 +0x57f
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).(github.com/elastic/beats/packetbeat/protos/thrift.readStruct)-fm(0xc42181050a, 0xc6, 0x1af6, 0xc4220bcdd0, 0xc7, 0xc421840101, 0xc7)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:681 +0x48
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readListOrSet(0xc4200da850, 0xc42180a013, 0x65bd, 0x7fed, 0x1, 0xc421040e00, 0xc4230b3780, 0x5e8cea)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:494 +0x148
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readList(0xc4200da850, 0xc42180a013, 0x65bd, 0x7fed, 0x20, 0xb27f60, 0xc4200a9401, 0xc421800ae0)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:522 +0x50
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).(github.com/elastic/beats/packetbeat/protos/thrift.readList)-fm(0xc42180a013, 0x65bd, 0x7fed, 0x416c01, 0xc4230b3800, 0x4eb933, 0x3)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:675 +0x48
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).readField(0xc4200da850, 0xc423110300, 0xbd7be6, 0x2c)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:715 +0x14f
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).messageParser(0xc4200da850, 0xc423110300, 0x1c48)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:767 +0x1a4
github.com/elastic/beats/packetbeat/protos/thrift.(*thriftPlugin).Parse(0xc4200da850, 0xc4217fd740, 0xc4218bb878, 0xc4200da801, 0xaf1240, 0xc421040d00, 0x0, 0x0)
/go/src/github.com/elastic/beats/packetbeat/protos/thrift/thrift.go:940 +0x1f9
github.com/elastic/beats/packetbeat/protos/tcp.(*TCPStream).addPacket(0xc4230b3b60, 0xc4217fd740, 0xc42126a5a0)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:115 +0x176
github.com/elastic/beats/packetbeat/protos/tcp.(*TCP).Process(0xc4212581e0, 0x0, 0xc42126a5a0, 0xc4217fd740)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:208 +0x3a2
github.com/elastic/beats/packetbeat/decoder.(*Decoder).onTCP(0xc42126a000, 0xc4217fd740)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:317 +0xee
github.com/elastic/beats/packetbeat/decoder.(*Decoder).process(0xc42126a000, 0xc4217fd740, 0x2c, 0x1c48, 0x1180dc0, 0xc42126a000)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:258 +0x222
github.com/elastic/beats/packetbeat/decoder.(*Decoder).OnPacket(0xc42126a000, 0xc421808044, 0x1c48, 0x1c48, 0xc42133ac90)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164 +0x343
github.com/elastic/beats/packetbeat/sniffer.(*SnifferSetup).Run(0xc42118f9e0, 0xc26fe0, 0xc421254210)
/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:381 +0x493
github.com/elastic/beats/packetbeat/beater.(*packetbeat).Run.func2(0xc421254210, 0xc420097400, 0xc421256300)
/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:155 +0x6a
created by github.com/elastic/beats/packetbeat/beater.(*packetbeat).Run
/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:159 +0x1b2
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 5:39am UTC](https://discuss.elastic.co/t/packetbeat-5-6-1-thrift-protocol-error-index-out-of-range/101635/2 "2017-10-23T05:39:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
