title: Logstash stopping randomly after few hours
body: <p>I'm getting a random error when I run logstash:</p>
  
  <blockquote>
    <p>16:30:26.240 [[main]>worker0] ERROR logstash.pipeline - Exception in
    pipelineworker, the pipeline stopped processing new events, please
    check your filter configuration and restart Logstash.
    {"exception"=>#,
    "backtrace"=>["org/jruby/RubyString.java:3101:in <code>gsub'",
    "org/jruby/RubyString.java:3069:in</code>gsub'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:317:in
    <code>gsub_dynamic_fields'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:308:in
    </code>gsub'", "org/jruby/RubyArray.java:1613:in <code>each'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290:in
    </code>gsub'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in
    <code>filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in
    </code>do_filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in
    <code>multi_filter'", "org/jruby/RubyArray.java:1613:in</code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in
    <code>multi_filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in
    </code>multi_filter'", "(eval):4135:in <code>initialize'",
    "org/jruby/RubyArray.java:1613:in</code>each'", "(eval):4131:in
    <code>initialize'", "org/jruby/RubyProc.java:281:in</code>call'", "(eval):997:in
    <code>filter_func'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in
    </code>filter_batch'", "org/jruby/RubyProc.java:281:in <code>call'",
    "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in
    </code>each'", "org/jruby/RubyHash.java:1342:in <code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:191:in
    </code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in
    <code>filter_batch'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in
    </code>worker_loop'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in
    <code>start_workers'"]} 16:30:26.542 [LogStash::Runner] FATAL
    logstash.runner - An unexpected error occurred!
    {:error=&gt;#&lt;InterruptedRegexpError: Regexp Interrupted&gt;,
    :backtrace=&gt;["org/jruby/RubyString.java:3101:in</code>gsub'",
    "org/jruby/RubyString.java:3069:in <code>gsub'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:317:in
    </code>gsub_dynamic_fields'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:308:in
    <code>gsub'", "org/jruby/RubyArray.java:1613:in</code>each'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290:in
    <code>gsub'",
    "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in
    </code>filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in
    <code>do_filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in
    </code>multi_filter'", "org/jruby/RubyArray.java:1613:in <code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in
    </code>multi_filter'",
    "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in
    <code>multi_filter'", "(eval):4135:in</code>initialize'",
    "org/jruby/RubyArray.java:1613:in <code>each'", "(eval):4131:in
    </code>initialize'", "org/jruby/RubyProc.java:281:in <code>call'", "(eval):997:in
    </code>filter_func'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in
    <code>filter_batch'", "org/jruby/RubyProc.java:281:in</code>call'",
    "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in
    <code>each'", "org/jruby/RubyHash.java:1342:in</code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:191:in
    <code>each'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in
    </code>filter_batch'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in
    <code>worker_loop'",
    "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in
    </code>start_workers'"]}</p>
  </blockquote>
  
  <p>My logstash config file is:</p>
  
  <pre><code>input {
      file {
          type =&gt; "SystemError"
          path =&gt; "/app/systemerr/**/*"
          start_position =&gt; "beginning"
  
  
          codec =&gt; multiline {
              pattern =&gt; "^\s"
              what =&gt; "previous"
          }      
      }
  
      file {
          type =&gt; "SystemOut"
          path =&gt; "/app/systemout/**/*"
              start_position =&gt; "beginning"
  
  
          codec =&gt; multiline {
              pattern =&gt; "^\["
              negate =&gt; true
              what =&gt; "previous"
          }
      }
  
      file {
              type =&gt; "Errorlog"
          path =&gt; "/app/error/**/*"
              start_position =&gt; "beginning"
  
  
          codec =&gt; multiline {
              pattern =&gt; "^FATAL"
              negate =&gt; true
              what =&gt; "previous"
          }
      }
  
      file {
              type =&gt; "Messagelog"
          path =&gt; "/app/message/**/*"
              start_position =&gt; "beginning"
  
  
          codec =&gt; multiline {
              pattern =&gt; "^ERROR"
              negate =&gt; true
              what =&gt; "previous"
          }      
      }
  }
  
  filter {
      if [type] == "SystemError" {
          grok {
              match =&gt; { "message" =&gt; "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?&lt;shortname&gt;\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" }
              overwrite =&gt; [ "message" ]
          }
  
          mutate {
              gsub =&gt; ["timestamp", " GMT\+05\:30", ""]
          }
  
          date {
              match =&gt; ["timestamp", "M/dd/yy HH:mm:ss:SSS"]
          }
  
          if ([message] =~ "^\tat") {
                  drop {}
          }
  
          if ([path] =~ "113") {
              mutate {
                      add_field =&gt; { "server" =&gt; "113" }
              }
          } else {
              mutate {
                      add_field =&gt; { "server" =&gt; "117" }
              }
          }
  
      }
  
      if [type] == "SystemOut" {
          grok {
              match =&gt; { "message" =&gt; "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?&lt;shortname&gt;\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" }
              overwrite =&gt; [ "message" ]
          }
  
          mutate {
              gsub =&gt; ["timestamp", " GMT\+05\:30", ""]
          }
  
          date {
              match =&gt; ["timestamp", "M/dd/yy HH:mm:ss:SSS"]
          }
  
          if ([path] =~ "113") {
              mutate {
                      add_field =&gt; { "server" =&gt; "113" }
              }
          } else {
              mutate {
                      add_field =&gt; { "server" =&gt; "117" }
              }
          }       
      }
  
      if [type] == "Errorlog" {
          grok {
              match =&gt; { "message" =&gt; "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" }
              overwrite =&gt; [ "message" ]
          }
  
          date {
              match =&gt; ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"]
          }
  
          mutate { remove_field =&gt; [ "string" ] }
  
          if ([path] =~ "113") {
              mutate {
                      add_field =&gt; { "server" =&gt; "113" }
              }
          } else {
              mutate {
                      add_field =&gt; { "server" =&gt; "117" }
              }
          }       
      }
  
      if [type] == "Messagelog" {
          grok {
              match =&gt; { "message" =&gt; "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" }
              overwrite =&gt; [ "message" ]
          }
  
          date {
              match =&gt; ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"]
          }
  
          mutate { 
              remove_field =&gt; [ "string" ]
          }
  
          if ([path] =~ "113") {
              mutate {
                      add_field =&gt; { "server" =&gt; "113" }
              }
          } else {
              mutate {
                      add_field =&gt; { "server" =&gt; "117" }
              }
          }       
  
      }
  
  }
  </code></pre>
  
  <p>Is there anything wrong in the config file? Please help.</p>