# What could be the cause of error ""

**URL:** https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436
**Category:** Logstash
**Created:** [December 15, 2023, 8:54am UTC](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436 "2023-12-15T08:54:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Chen\_Wei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chen_wei/32/127587_2.png) [@Chen\_Wei](https://discuss.elastic.co/u/Chen_Wei)
#### Post date: [December 15, 2023, 8:54am UTC](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436/1 "2023-12-15T08:54:40Z")

</div>

I recently met a error about timestamp, the error appears after the logstash pipeline start and work for a while. I could not reproduce it. But I wonder where the error could happen. Does it happen in the input plugin? since it says something about the codec.

Pipeline worker error  
the pipeline will be stopped {:pipeline\_id=\>"main"  
:error=\>"(GeneratorError) Cannot invoke "org.logstash.Timestamp.toString()" because the return value of "org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp.getTimestamp()" is null (through reference chain: org.logstash.ConvertedMap["\_@timestamp"])"  
:exception=\>Java::OrgJrubyExceptions::Exception  
:backtrace=\>["RUBY.encode(/log\_analyzer/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-codec-json-3.1.1/lib/logstash/codecs/json.rb:69)"  
"RUBY.encode(/log\_analyzer/logstash/logstash-core/lib/logstash/codecs/delegator.rb:48)"  
"org.logstash.instrument.metrics.AbstractSimpleMetricExt.time(org/logstash/instrument/metrics/AbstractSimpleMetricExt.java:74)"  
"org.logstash.instrument.metrics.AbstractNamespacedMetricExt.time(org/logstash/instrument/metrics/AbstractNamespacedMetricExt.java:68)"  
"RUBY.encode(/log\_analyzer/logstash/logstash-core/lib/logstash/codecs/delegator.rb:47)"  
"RUBY.multi\_receive(/log\_analyzer/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-11.3.2-java/lib/logstash/outputs/kafka.rb:222)"  
"org.jruby.RubyArray.each(org/jruby/RubyArray.java:1987)"  
"RUBY.multi\_receive(/log\_analyzer/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-kafka-11.3.2-java/lib/logstash/outputs/kafka.rb:221)"  
"org.logstash.config.ir.compiler.AbstractOutputDelegatorExt.multi\_receive(org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:121)"  
"RUBY.start\_workers(/log\_analyzer/logstash/logstash-core/lib/logstash/java\_pipeline.rb:304)"]  
:thread=\>"#\<Thread:0xfd57d9a /log\_analyzer/logstash/logstash-core/lib/logstash/java\_pipeline.rb:134 sleep\>"}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 15, 2023, 7:07pm UTC](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436/2 "2023-12-15T19:07:29Z")

</div>

This answer includes speculation....

The error in in the kafka output, which is calling a json codec. It is trying to encode a field. It seems likely that that field is called "\_@timestamp". That field would get created if you have a json codec on an _input_ and it receives JSON "@timestamp": "something that is not a valid time".

I am not inclined to work out what might provoke [the code](https://github.com/elastic/logstash/blob/aa05205a9eaf3a58670bc54b784fbb6b6eb297c3/logstash-core/src/main/java/org/logstash/ext/JrubyTimestampExtLibrary.java#L63) to return null, nor do I understand the message about the reference chain.

The underlying error is probably that a json codec on an _input_ is failing to parse a field called @timestamp.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 12, 2024, 7:08pm UTC](https://discuss.elastic.co/t/what-could-be-the-cause-of-error/349436/3 "2024-01-12T19:08:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
