# Can't dup NilClass event.get() **URL:** \ **Category:** Logstash\ **Created:** [May 17, 2018, 8:01am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276 "2018-05-17T08:01:05Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![vicennt](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicennt](https://discuss.elastic.co/u/vicennt)\ **Post date:** [May 17, 2018, 8:01am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/1 "2018-05-17T08:01:05Z")
Hi there! First sorry for my English. I have a problem when I try to get the value from grok field. I'm using the event.get but when I try to pass this value to a Time.parse() I always get `Can't dup NilClass error'. ERROR: `[ERROR] 2018-05-17 09:51:32.407 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass` My grok pattern is this: ``` grok { match => { "message" => "(?:\[%{DATA:apache.date_dayname} %{DATA:apache.date_month} %{DATA:apache.date_day} %{DATA:apache.hour} %{DATA:apache.date_year}\]) (?:\[%{DATA:apache.event}?:%{DATA:apache.event_result}\]) (?:\[%{DATA:apache.pid}\]) (?:\[client %{DATA:apache.ip}?:%{DATA:apache.port}\]) %{DATA:apache.errorcode}?: user %{DATA:apache.user}?: authentication %{DATA:apache.auth_result} for %{DATA:apache.urlaccess}?:" } } ``` And my ruby code: ``` ruby { code => " require 'time'; hour = event.get('%{apache.hour}'); arg = Time.parse(hour); ini = Time.parse('08:00:00'); fin = Time.parse('17:00:00'); if (arg.hour >= ini.hour) and (arg.hour <= fin.hour) event.set('office_hour','intime'); end " } ``` Thanks! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 17, 2018, 12:26pm UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/2 "2018-05-17T12:26:24Z")
> [@vicennt](#): > > hour = event.get('%{apache.hour}'); This should be ``` hour = event.get('apache.hour'); ``` Using . in a field name will work most of the time, except for those times where it does not work. It is unsupported. If you want hour to be nested inside apache then change both references to be [apache][hour] ---
**Author:** ![vicennt](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicennt](https://discuss.elastic.co/u/vicennt)\ **Post date:** [May 23, 2018, 9:24am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/3 "2018-05-23T09:24:26Z")
I changed de grok pattern: ``` %{DATA:test} ``` And the event.get line: ``` hour = event.get('test'); ``` But the error persist. I don't understant, because if I set this value to another field: ``` event.set('office_hour', hour) ``` The finally value into office\_hour is correct. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 27, 2018, 8:15pm UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/4 "2018-05-27T20:15:37Z")
The error could be related to your excessive use of DATA patterns. Those are a performance killer anyway so I suggest you rewrite the grok expression to use more exact patterns. If it still doesn't work, post your updated configuration and an example event produced by Logstash (use a `stdout { codec => rubydebug }` output). ---
**Author:** ![vicennt](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicennt](https://discuss.elastic.co/u/vicennt)\ **Post date:** [May 28, 2018, 7:24am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/5 "2018-05-28T07:24:16Z")
Hi Magnus, thanks for your response. Firstly I update the grok pattern to use more exact patterns: ``` (?:\[%{DAY:dayname} %{MONTH:month} %{DATA:day} %{TIME:hour} %{YEAR:year}\]) (?:\[%{WORD:event}?:%{WORD:resultevent}\]) (?:\[pid %{NUMBER:pid}\]) (?:\[client %{IPV4:ipdirection}?:%{NUMBER:port}\]) %{WORD:errorcode}?: user %{USERNAME:user}?: authentication %{WORD:authresult} for %{DATA:urlaccess}?: ``` My configuration: ``` input { beats { port => "5046" } } filter { grok { match => { "message" => "(?:\[%{DAY:dayname} %{MONTH:month} %{DATA:day} %{TIME:hour} %{YEAR:year}\]) (?:\[%{WORD:event}?:%{WORD:resultevent}\]) (?:\[pid %{NUMBER:pid}\]) (?:\[client %{IPV4:ipdirection}?:%{NUMBER:port}\]) %{WORD:errorcode}?: user %{USERNAME:user}?: authentication %{WORD:authresult} for %{DATA:urlaccess}?:"} } geoip { source => "ipdirection" } ruby { add_field => {"office_hour" => "outoftime"} code => " require 'time' h = event.get('hour'); arg = Time.parse(h); inicio = Time.parse('12:00:00'); final = Time.parse('15:00:00'); if (arg.hour >= inicio.hour) and (arg.hour <= final.hour) event.set('office_hour','intime'); end " } if "_grokparsefailure" in [tags] { drop { } } } output { elasticsearch { hosts => ["192.168.126.6:9200"] index => "apacheaccesslog" } stdout { codec => rubydebug } } ``` But the error persist, the output of the terminal is always: ``` [ERROR] 2018-05-28 09:15:46.835 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.836 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.847 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.847 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.847 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.848 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.848 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.848 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.848 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.849 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.849 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.849 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.849 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass [ERROR] 2018-05-28 09:15:46.850 [Ruby-0-Thread-10@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385] ruby - Ruby exception occurred: can't dup NilClass ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 9:56am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/6 "2018-05-28T09:56:56Z")
Is the grok filter always successful, i.e. is the `hour` field always set? ---
**Author:** ![vicennt](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicennt](https://discuss.elastic.co/u/vicennt)\ **Post date:** [May 28, 2018, 10:10am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/7 "2018-05-28T10:10:20Z")
> [@magnusbaeck](#): > > Is the grok filter always successful, i.e. is the `hour` field always set? Yes. If I comment the ruby code, an example of event produced by Logstash is this: ``` { "hour" => "13:57:45.241518", "tags" => [ [0] "beats_input_codec_plain_applied" ], "source" => "/var/log/httpd/error_log", "event" => "auth_basic", "authresult" => "failure", "port" => "54725", "ipdirection" => "62.190.56.0", "year" => "2018", "user" => "USER_LONDON", "offset" => 1220043, "urlaccess" => "\"/kibana\"", "month" => "May", "errorcode" => "AH01617", "resultevent" => "error", "beat" => { "name" => "formacionkibana", "hostname" => "formacionkibana", "version" => "6.2.4" }, "@timestamp" => 2018-05-28T10:07:01.011Z, "dayname" => "Fri", "day" => "11", "@version" => "1", "host" => "formacionkibana", "message" => "[Fri May 11 13:57:45.241518 2018] [auth_basic:error] [pid 7014] [client 62.190.56.0:54725] AH01617: user USER_LONDON: authentication failure for \"/kibana\": Password Mismatch", "pid" => "7014", "prospector" => { "type" => "log" }, "geoip" => { "ip" => "62.190.56.0", "country_name" => "United Kingdom", "timezone" => "Europe/London", "location" => { "lon" => -0.1224, "lat" => 51.4964 }, "latitude" => 51.4964, "country_code2" => "GB", "continent_code" => "EU", "longitude" => -0.1224, "country_code3" => "GB" }, "office_hour" => "outoftime" } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2018, 11:54am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/8 "2018-05-28T11:54:05Z")
Are you sure that's an event that didn't work with the ruby filter? To narrow down the problem you can always comment out parts of the Ruby code. ---
**Author:** ![vicennt](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicennt](https://discuss.elastic.co/u/vicennt)\ **Post date:** [May 29, 2018, 6:38am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/9 "2018-05-29T06:38:18Z")
Hi, Finally the problem is the code order. Because I don't remove the events that do not do maching before the ruby code. If I put the conditional to remove events with "\_grokparsefailure" before the ruby code I don't get any error. This is the finally pipeline configuration: ``` input { beats { port => "5046" } } filter { grok { match => { "message" => "(?:\[%{DAY:dayname} %{MONTH:month} %{DATA:day} %{TIME:hour} %{YEAR:year}\]) (?:\[%{WORD:event}?:%{WORD:resultevent}\]) (?:\[pid %{NUMBER:pid}\]) (?:\[client %{IPV4:ipdirection}?:%{NUMBER:port}\]) %{WORD:errorcode}?: user %{USERNAME:user}?: authentication %{WORD:authresult} for %{DATA:urlaccess}?:"} } geoip { source => "ipdirection" } if "_grokparsefailure" in [tags] { drop { } } if "_geoip_lookup_failure" in [tags] { drop {} } ruby { add_field => {"office_hour" => "outoftime"} code => " require 'time' h = event.get('hour'); arg = Time.parse(h); inicio = Time.parse('12:00:00'); final = Time.parse('15:00:00'); if (arg.hour >= inicio.hour) and (arg.hour <= final.hour) event.set('office_hour','intime'); end " } } output { elasticsearch { hosts => ["192.168.126.6:9200"] index => "apacheaccesslog" } stdout { codec => rubydebug } } ``` Thanks for all magnus and Badger! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2018, 6:42am UTC](https://discuss.elastic.co/t/cant-dup-nilclass-event-get/132276/10 "2018-06-26T06:42:04Z")
Closed on June 26, 2018, 6:42am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.