Frequent "Log event encoder error : -4" and "-12" messages in my fluent-bit log for various filters

[dw-eyecon]

Hi All,

I'm struggling to find any information on this mysterious error I continually get in my fluent-bit logs. Running 4.0.10 on Oracle Linux 9.6.

[2025/10/07 13:26:52] [error] [filter:lua:lua.3] Log event encoder error : -4
[2025/10/07 13:26:52] [error] [filter:lua:lua.3] Log event encoder error : -4
[2025/10/07 13:26:54] [error] [filter:lua:lua.3] Log event encoder error : -4
[2025/10/07 13:26:55] [error] [filter:lua:lua.3] Log event encoder error : -4
[2025/10/07 13:26:55] [error] [filter:lua:lua.3] Log event encoder error : -4

#and

[2025/10/10 09:33:25.469295268] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:25.470449196] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:25.794384768] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:26.543461218] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:26.732810616] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12

I get this error for some of my lua and just simple rewrite_tag filters but even with trace logging on I can't see what the offending log is that is causing the errors.

Any advice would be greatly appreciated!

[patrick-stephens]

Does it still happen with the latest 4.0.12 and 4.1.0 versions?

[dw-eyecon]

Tried on 4.0.12 and 4.1.0 and still occuring but now also getting

[2025/10/09 00:01:22.272563684] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12

Is there anything that describes these error codes and what they mean?

[dw-eyecon]

Tried on 4.0.12 and 4.1.0 and still occuring but now also getting

[2025/10/09 00:01:22.272563684] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12

Is there anything that describes these error codes and what they mean?

Actually I didn't try on 4.0.12. Just tried now. Seems the issue is gone on that version, but then is re-introduced in 4.1.0 ?

I'm currently changing all my fluent-bit servers/clients to 4.0.12.

[patrick-stephens]

There is also 4.1.1 now so maybe try that too and if so raise a regression issue between 4.0.12 and 4.1

[dw-eyecon]

There is also 4.1.1 now so maybe try that too and if so raise a regression issue between 4.0.12 and 4.1

Switched to 4.1.1 on one of my central log aggregators and immediately:

[2025/10/10 09:33:25.469295268] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:25.470449196] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:25.794384768] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:26.543461218] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:26.732810616] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:27.234548126] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:27.719476322] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:28.184574764] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:28.744722093] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:28.899695820] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:29.786174621] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12
[2025/10/10 09:33:30.73407331] [error] [filter:rewrite_tag:rewrite_tag.0] Log event encoder error : -12

How would you suggest I best raise a regression issue for fluent-bit?

[patrick-stephens]

Just raise an issue ideally with a simple reproducer