# Why my Logstash work normal with an recursively error log

**URL:** <https://discuss.elastic.co/t/why-my-logstash-work-normal-with-an-recursively-error-log/341537>\
**Category:** Logstash\
**Created:** [August 24, 2023, 5:33am UTC](https://discuss.elastic.co/t/why-my-logstash-work-normal-with-an-recursively-error-log/341537 "2023-08-24T05:33:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![waitspring](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waitspring/32/124922_2.png) [@waitspring](https://discuss.elastic.co/u/waitspring)\
**Post date:** [August 24, 2023, 5:33am UTC](https://discuss.elastic.co/t/why-my-logstash-work-normal-with-an-recursively-error-log/341537/1 "2023-08-24T05:33:56Z")

</div>

I have make my logstash conf as:

```auto
... ...
filter {
    grok {
        match => {
            "message" => [
                "\<时间: (?<timestamp>.*)\> \<进程号:(?<process>%{NUMBER}+)\>(?<body>.*$)",
                "\<时间:(?<timestamp>.*)\> \<进程号:\[(?<process>%{NUMBER}+)\]\>(?<body>.*$)",
                "\<时间：(?<timestamp>.*)\> \<进程号:\[(?<process>%{NUMBER}+)\]\>(?<body>.*$)",
                "\[(?<timetsmp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND})\](?<body>.*$)",
                "\[(?<timestamp>%{MONTHNUM}%{MONTHDAY}-%{HOUR}%{MINUTE}%{SECOND}\.\d{6}) (?<thread>.*) [^\[\]]* [A-Z]+\]:(?<body>.*$)",
                "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.\d{3})%{SPACE}*%{LOGLEVEL:level}%{SPACE}*\[%{DATA:feature}\]%{SPACE}*(?<body>.*$)",
                "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}\.\d{3})%{SPACE}*%{LOGLEVEL:level}%{SPACE}*(?<body>.*$)"
            ]
        }
    }
    if [timestamp] != "" {
        date {
            match => [
                "timestamp",
                "yyyyMMdd HHmmss SSS",
                "yyyy-MM-dd HH:mm:ss",
                "MMdd-HHmmss.SSSSSS",
                "yyyy-MM-dd HH:mm:ss.SSS"
            ]
        }
    } else {
        ruby {
            code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)"
        }
    }
    ruby {
        code => "event.set('@timestamp', event.get('timestamp'))"
    }
    mutate {
        remove_field => [
            "tags",
            "host",
            "timestamp",
            "offset",
            "beat",
            "input",
            "log",
            "prospector",
            "@version"
        ]
    }
}
... ...

```

Logstash can work well with this conf file but output many error message in one same:

```auto
2023-08-24 13:21:53.120 ERROR [logstash.filters.ruby] Ruby exception occurred: wrong argument type String (expected LogStash::Timestamp) {:class=>"TypeError", :backtrace=>["org/logstash/ext/JrubyEventExtLibrary.java:95:in `set'", "(ruby filter code):2:in `block in filter_method'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:93:in `inline_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:86:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:in `block in multi_filter'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in `multi_filter'", "(eval):172:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start_workers'"]}

```

How can I resolve this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 24, 2023, 2:07pm UTC](https://discuss.elastic.co/t/why-my-logstash-work-normal-with-an-recursively-error-log/341537/2 "2023-08-24T14:07:52Z")

</div>

> [@waitspring](#):
>
> `code => "event.set('@timestamp', event.get('timestamp'))"`

timestamp is a string. I can see that you have attempted to ensure that it is, but it has not worked. I would suggest adding "puts timestamp" to the second ruby filter to see what it is, and maybe additional debugging code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2023, 2:08pm UTC](https://discuss.elastic.co/t/why-my-logstash-work-normal-with-an-recursively-error-log/341537/3 "2023-09-21T14:08:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.