logstash plugin load error : 'cabin/metrics', 'cabin/log/logger', 'logstash::codecs::multiline::Grok' error

[LiYuzhuo2020]

No description provided.

[andsel]

Hi @LiYuzhuo2020 thanks for reporting this and getting in touch about it.
However to investigate the root cause, we need your help and more information.
Could you provide a portion of your logs around the error, in particular the full stacktrace of the error and the message, please 🙏 ?

[LiYuzhuo2020]

and for the plugin load error 'logstash::codecs::multiline' GROK I think it's throwed here

logstash-codec-multiline:

def register
### when require grok-pure it will failed to require it and throw error unable to configure plugin : "grok-pure/discovery" (not happened each time when I restart it, it has certain probability of occurring. )
require "grok-pure" # rubygem 'jls-grok'
require 'logstash/patterns/core'

# Detect if we are running from a jarfile, pick the right path.
patterns_path = []
patterns_path += [LogStash::Patterns::Core.path]

@grok = Grok.new

@patterns_dir = patterns_path.to_a + @patterns_dir
@patterns_dir.each do |path|
  if ::File.directory?(path)
    path = ::File.join(path, "*")
  end

  Dir.glob(path).each do |file|
    @logger.debug("Grok loading patterns from file", :path => file)
    @grok.add_patterns_from_file(file)
  end
end

[andsel]

These are really strange errors, in Logstash 8.12.0 and 8.11.3 JRuby was switched from 9.4.2.0 to 9.4.5.0.
Maybe it's related to JRuby version.
To confirm that, would you try your configuration with Logstash 8.11.2

[andsel]

Hi @LiYuzhuo2020 thanks for confirming, maybe it's related to the fact that in JRuby patch doesn't change so much, maybe worthwhile to test also with a previous minor JRuby (9.3.10.0) which was shipped with Logstash 8.9.2.
However, I would like to be able to reproduce locally, could you share more on your environment, please?

• jvm.options
• pipelines definitions
• first line of logs when you start Logstash (around Starting Logstash), where Logstash prints, JVM version, OS, CPU arch, set of startup flags etc.

[LiYuzhuo2020]

Hi @andsel , how's your progress, is this a bug or just need myself to adjust the configuration file?

[LiYuzhuo2020]

sometimes even cannot find the 'add_patterns_from_file' method ...

[andsel]

Hi @LiYuzhuo2020, no sorry no news, the information provided is not of much value. To try to understand what's happening the log (in textual form and not image) should be provided, and must cover from the start of Logstash till the reported error. Maybe better at debug level (start Logstash with --debug).

We have to figure out how to reproduce, so if you can isolate a minimal pipeline definition that manifest the problem with a certain probability would be great. Without that it's hard to share what's the problem.

[LiYuzhuo2020]

I found this error log

illegal access of jruby

[LiYuzhuo2020]

Hi @andsel thanks for your information, I followed your advice commented out other pipeline and investigate one by one finally found out the cause, it's due to one of my pipeline has timestamp convert error

[andsel]

Great @LiYuzhuo2020 ! Once it's fixed for you, please 🙏 close the issue.

[LiYuzhuo2020]

Hi @andsel , the issue looks like caused by the default geoIp database, I disabled it, it's much stable now.

but sometimes there has the probability of occurring the 'string index out of range -1 ' without any plugin load error message . I'm quiet confused about that why don't raise some more useful information when configure failed but raised the illegalStateException 囧