Cannot convert String into Integer

Elastic Stack Logstash
1

I am using logstash 2.3.4 - the configuration worked for previous inputs in file, some input is now crashing it. How to find the error log line?

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert String into Integer>, "backtrace"=>["org/jruby/RubyFixnum.java:1143:in []'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.4-java/lib/logstash/util/accessors.rb:56:inget'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.4-java/lib/logstash/event.rb:122:in []'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.4-java/lib/logstash/string_interpolation.rb:118:inevaluate'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.4-java/lib/logstash/string_interpolation.rb:27:in evaluate'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.3.4-java/lib/logstash/event.rb:199:insprintf'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/util/decorators.rb:20:in add_fields'", "org/jruby/RubyArray.java:1613:ineach'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/util/decorators.rb:19:in add_fields'", "org/jruby/RubyHash.java:1342:ineach'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/util/decorators.rb:16:in add_fields'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/filters/base.rb:171:infilter_matched'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-2.0.6/lib/logstash/filters/mutate.rb:230:in filter'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/filters/base.rb:151:inmulti_filter'", "org/jruby/RubyArray.java:1613:in each'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/filters/base.rb:148:inmulti_filter'", "(eval):238:in filter_func'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267:infilter_batch'", "org/jruby/RubyArray.java:1613:in each'", "org/jruby/RubyEnumerable.java:852:ininject'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265:in filter_batch'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223:inworker_loop'", "/home/sme/monitor/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}

2

Can you show your config.

3 
Please see below filter clause in config file,

filter {
    grok {
        match => [ "message", "%{TIMESTAMP_ISO8601:logTimestampString} \[%{WORD:logMode}\]: Server %{WORD:messageType}:%{GREEDYDATA:jsonObject}"]
    }
    json {
        source => "jsonObject"
        target => "doc"
    }
    if ([messageType] == "Request") {
        date {
            locale => "en"
            match => ["logTimestampString", "YYYY-MM-dd HH:mm:ss"]
            target => "requestLogTimestamp"
        }
        mutate {
            add_field => {
                "requestType" => "%{[doc][requestType]}"
            }
        }
    }
    else if ([messageType] == "Response"){
        date {
            locale => "en"
            match => ["logTimestampString", "YYYY-MM-dd HH:mm:ss"]
            target => "responseLogTimestamp"
        }
        if ([doc][message] != "success") {
            mutate {
                add_field => {
                    "ErrorMessage" => "%{[doc][reply][ErrorMessage]}"
                }
            }
        }
        mutate  {
            add_field => {
                "messageStatus" => "%{[doc][message]}"
            }
        }
    }
    mutate {
        add_field => {
                "requestID" => "%{[doc][requestID]}"
        }
        remove_field => [ "jsonObject", "doc", "path", "logTimestampString", "reply", "request", "message"]
    }
}
4

Same issue here also for me. I'm using 2.4.1 version of logstash. Issue is with event_id condition in filter section(I'm taking even_id as integer). It seems there is an issue with mutate. It is working fine in output section on same event_id field

Error message:
Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert String into Integer>, "backtrace"=>["org/jruby/RubyFixnum.java:1143:in []'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/util/accessors.rb:56:inget'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/event.rb:122:in get'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/string_interpolation.rb:118:inevaluate'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/string_interpolation.rb:90:in evaluate'", "org/jruby/RubyArray.java:2409:incollect'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/string_interpolation.rb:90:in evaluate'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/string_interpolation.rb:27:inevaluate'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-event-2.4.1-java/lib/logstash/event.rb:202:in sprintf'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/util/decorators.rb:20:inadd_fields'", "org/jruby/RubyArray.java:1613:in each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/util/decorators.rb:19:inadd_fields'", "org/jruby/RubyHash.java:1342:in each'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/util/decorators.rb:16:inadd_fields'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/filters/base.rb:171:in filter_matched'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-2.0.6/lib/logstash/filters/mutate.rb:230:infilter'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/filters/base.rb:151:in multi_filter'", "org/jruby/RubyArray.java:1613:ineach'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/filters/base.rb:148:in multi_filter'", "(eval):154:ininitialize'", "org/jruby/RubyArray.java:1613:in each'", "(eval):151:ininitialize'", "org/jruby/RubyProc.java:281:in call'", "(eval):104:infilter_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:267:in filter_batch'", "org/jruby/RubyArray.java:1613:ineach'", "org/jruby/RubyEnumerable.java:852:in inject'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:265:infilter_batch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:223:in worker_loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.1-java/lib/logstash/pipeline.rb:201:instart_workers'"], :level=>:error}

Configuration:
input {
beats{
port => 5044
type => AD
}
}

filter {
mutate{
gsub => [ "message", "\n", "",
"message", "\t", " "
]
}
mutate{
convert => { "event_id" => "integer" }
}
if [event_id] in [ 4624, 4625] {
mutate {
add_field => {
"message" => "EventID=%{event_id}"
}
add_field => {
"message" => "Origin=%{[event_id][WorkstationName]}"
}
add_field => {
"message" => "Status=%{Keywords}"
}
}
}
}

output {

    if [event_id] in [ 4720, 4722, 4725, 4726, 5136, 4740, 4624, 4625, 4738, 529, 533, 539, 552, 4735, 4657, 7045, 4698, 4702] {
           stdout { codec => rubydebug  }
           syslog {
                   host => "10.107.105.239"
                   port => 514
                   protocol => "tcp"
                   rfc => "rfc5424"
                   appname => "adlogs"
           }
                elasticsearch {
                            hosts => elasticsearchserver
                            ssl => true
                            cacert => "/etc/logstash/pki/caroottest.pem"
                            index => "adlogs-%{+YYYY.MM.dd}"
                            user => "logstash"
                            password => "logstash"
                }
    }

}