# Request Rate changes at a specific hour

**URL:** <https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291>\
**Category:** Elasticsearch\
**Created:** [August 9, 2020, 7:46am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291 "2020-08-09T07:46:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Burga](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@Burga](https://discuss.elastic.co/u/Burga)\
**Post date:** [August 9, 2020, 7:46am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/1 "2020-08-09T07:46:38Z")

</div>

Hi i'm handling request rate degradation and I noticed that some of my nodes behaving strange , exactly at 03:04 every night request rate Either drops from 900 to 200 or climb up from 200 to 900

I'm not sure this is normal behavior

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac249e6cc11be2372dc6e395833be37bc07d67e3.png)

---

<div class="post-metadata">

**Author:** ![Burga](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@Burga](https://discuss.elastic.co/u/Burga)\
**Post date:** [August 9, 2020, 10:25am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/2 "2020-08-09T10:25:50Z")

</div>

Hi guys ,any Ideas ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 9, 2020, 10:47pm UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/3 "2020-08-09T22:47:30Z")

</div>

We aren't all guys 🙂

What do your Elasticsearch logs for the nodes in question show at this time?

---

<div class="post-metadata">

**Author:** ![Burga](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@Burga](https://discuss.elastic.co/u/Burga)\
**Post date:** [August 11, 2020, 7:09am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/4 "2020-08-11T07:09:15Z")

</div>

🙂 , you are right , sorry  
I found the problem , logstash server is bounces with  
multiline exception

* * *

[2020-08-11T00:58:25,215][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<NoMethodError: undefined method `to_hash_with_metadata' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:273:in `block in merge'", "org/jruby/RubyArray.java:1734:in `each'", "org/jruby/RubyEnumerable.java:936:in `inject'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:272:in `merge'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:202:in `block in flush'", "org/jruby/RubyHash.java:1343:in `each'", "org/jruby/RubyEnumerable.java:830:in `map'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-multiline-3.0.4/lib/logstash/filters/multiline.rb:200:in `flush'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:60:in `block in define\_flush\_method'", "(eval)💯in `block in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:602:in `block in flush\_filters'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:601:in `flush\_filters'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:642:in `flush_filters_to_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:424:in `worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:384:in `block in start\_workers'"]}

the condition in filter looks like :

```auto
 if [logger] == "stderr" {
      multiline {
        pattern => "^\t"
        what => previous
      }
    }

```

please advice what can be done to avoid logstash bounce .

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 11, 2020, 7:11am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/5 "2020-08-11T07:11:07Z")

</div>

It might be better to post something in the Logstash category with a bit more detail.

---

<div class="post-metadata">

**Author:** ![Burga](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@Burga](https://discuss.elastic.co/u/Burga)\
**Post date:** [August 11, 2020, 8:05am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/6 "2020-08-11T08:05:23Z")

</div>

I will , Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2020, 8:05am UTC](https://discuss.elastic.co/t/request-rate-changes-at-a-specific-hour/244291/7 "2020-09-08T08:05:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.