# Udp input with multiline codec - Exception in inputworker

**URL:** <https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079>\
**Category:** Logstash\
**Created:** [January 11, 2018, 11:57am UTC](https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079 "2018-01-11T11:57:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [January 11, 2018, 11:57am UTC](https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079/1 "2018-01-11T11:57:50Z")

</div>

Logstash falls every 2-3 days. Is there anything i can do about this?

```
"@timestamp"=>2018-01-10T16:30:00.523Z, "message"=>"", "tags"=>["_dissectfailure"]}}
[2018-01-10T16:30:02,636][WARN][org.logstash.dissect.Dissector] Dissector mapping, field found in event but it was empty {"field"=>"message", "event"=>{"@version"=>"1", "host"=>"172.31.21.189", "@timestamp"=>2018-01-10T16:30:02.631Z, "message"=>"", "tags"=>["_dissectfailure"]}}
[2018-01-10T16:30:26,740][WARN][org.logstash.dissect.Dissector] Dissector mapping, field found in event but it was empty {"field"=>"message", "event"=>{"@version"=>"1", "host"=>"172.31.21.189", "@timestamp"=>2018-01-10T16:30:26.734Z, "message"=>"", "tags"=>["_dissectfailure"]}}
[2018-01-10T16:30:42,918][ERROR][logstash.inputs.udp] Exception in inputworker {"exception"=>#<ConcurrencyError: Detected invalid array contents due to unsynchronized modifications with concurrent users>, "backtrace"=>["org/jruby/RubyArray.java:1256:in `<<'", "org/jruby/RubyArray.java:1271:in `push'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:211:in `buffer'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:269:in `do_previous'", "org/jruby/RubyMethod.java:119:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:205:in `block in decode'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:198:in `decode'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:118:in `inputworker'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:89:in `block in udp_listener'"]}

[2018-01-10T16:30:42,919][ERROR][logstash.inputs.udp] Exception in inputworker {"exception"=>#<ConcurrencyError: Detected invalid array contents due to unsynchronized modifications with concurrent users>, "backtrace"=>["org/jruby/RubyArray.java:1256:in `<<'", "org/jruby/RubyArray.java:1271:in `push'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:211:in `buffer'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:269:in `do_previous'", "org/jruby/RubyMethod.java:119:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:205:in `block in decode'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-multiline-3.0.7/lib/logstash/codecs/multiline.rb:198:in `decode'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:118:in `inputworker'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:89:in `block in udp_listener'"]}

```

config:

```
input {
  udp {
    port => 5200
    codec => multiline {
      pattern => "^([a-zA-Z0-9-]+.[a-zA-Z0-9-]+.[a-zA-Z0-9-]+) (DEBUG .+)|(INFO .+)|(ERROR .+)|(WARNING .+)"
      negate => true
      what => "previous"
    }
  }
}

filter {
    dissect {
      mapping => { "message" => "%{host} %{levelname} %{name} %{asctime} %{+asctime} %{module} %{process} %{thread} %{message}"}
    }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }

}

```

Logstash 6.0.0 Centos Linux 3.10.0-693.5.2.el7.x86\_64  
java version "1.8.0\_131"  
Java(TM) SE Runtime Environment (build 1.8.0\_131-b11)  
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 11, 2018, 12:21pm UTC](https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079/2 "2018-01-11T12:21:47Z")

</div>

As delivery of UDP message are not necessarily ordered nor guaranteed, I am not sure how well a multiline codec is going to work. What is the rationale behind using it here? Why not use TCP instead?

---

<div class="post-metadata">

**Author:** ![breezzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/breezzz/32/18245_2.png) [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Post date:** [January 11, 2018, 12:32pm UTC](https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079/3 "2018-01-11T12:32:02Z")

</div>

multiline basically works fine. The problem was when collecting logs from several hosts, for logs from one server, the host field was contain ip from second server, i was resolve this problem with the host field added to msg before transfer. UDP is faster.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 12:32pm UTC](https://discuss.elastic.co/t/udp-input-with-multiline-codec-exception-in-inputworker/115079/4 "2018-02-08T12:32:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.