Logstash - Error at startup - Cannot determine timezone from nil

Elastic Stack Logstash
1

Hi,
I've stumbled upon a problem with my Logstash config. As soon as I use the translate filter Logstash refuses to start.

I use the following minimal config to reproduce the issue:

input { 
  stdin { } 	
} 

filter {
	mutate {
		add_field => {  "foo" => "bar"	}
	}

 translate {
   source => "[foo]"
   target => "[foo_txt]"
   dictionary => {
     "foo" => "bar"
     "foo2" => "bar2"
   }
   fallback => "unkownMapping"
 }
}

output { 
	stdout {} 
}

Logstash version is: 8.13.4
OS is Windows (Server 2025 or Win11)
Logstash start command:

logstash -f minimal.conf

Timezone settings on my machine with tzutil /g is W. Europe Standard Time

I get the following error (linebreaks added for readability):

{:action=>LogStash::PipelineAction::Create/pipeline_id:main,
 :exception=>"Java::JavaLang::IllegalStateException",
 :message=>"Unable to configure plugins: (ArgumentError) Cannot determine timezone from nil
 (secs:1748251030.098,utc~:\"2025-05-26 09:17:10.09800004959106445\",ltz~:nil)
 (etz:nil,tnz:\"MESZ\",tziv:\"2.0.6\",tzidv:\"1.2024.1\",rv:\"3.1.4\",rp:\"java\",win:true,rorv:nil,astz:nil,eov:\"1.2.11\",eotnz:\"???\",eotnfz:\"???\",eotlzn:\"???\",
 debian:nil,centos:nil,osx:nil)
 Try setting `ENV['TZ'] = 'Continent/City'` in your script (see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)",
 :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:120)", 
"org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)", 
"org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", 
"org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)", 
"org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1319)", 
"org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:139)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:367)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:128)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", 
"org.jruby.RubyClass.newInstance(RubyClass.java:931)", 
"org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", 
"org.jruby.ir.instructions.CallBase.interpret(CallBase.java:548)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:367)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:88)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:238)", 
"org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)", 
"org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:228)", 
"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:476)", 
"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:293)", 
"org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:328)", 
"org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", 
"org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:116)", 
"org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)", 
"org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)", 
"org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", 
"org.jruby.runtime.Block.call(Block.java:144)", 
"org.jruby.RubyProc.call(RubyProc.java:352)", 
"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)", 
"java.base/java.lang.Thread.run(Thread.java:840)"]}

If I remove the translate filter in the above config everything is working as expected. The error also occurs if I start Logstash to just check the config (with -t flag).

Any idea what is going wrong / what I'm missing?

1 Like
2

looks similar to:

There:

Setting the environment variable TZ resolves this issue.

Have you that environment variable set ? If so, to what? "Europe/Berlin" or similar would seem appropriate.

3

Hi,
thanks for your reply. I failed to related the other posts with this error message to my scenario as they all regarded the JDBC input whereas I'm using the translate filter.

What I don't understand however is that in our production setup Logstash runs as a windows service without the TZ env variable set and that seems to be working fine...

Any idea on why that is?

4

Mid-european summer time is not one of the time zone names that Joda understands, so, as the error message says, try setting ENV['TZ'] = 'Continent/City'. See this thread.

A translate filter has a schedule (refresh_interval), so it needs to know what time the next refresh should occur.

1 Like