CIDR filter network_path error

Elastic Stack Logstash
1

Hi,

logstash-6.5.3-1.noarch on RHEL

I get the following error when using the cidr filter with network_path

[2019-02-23T21:30:16,297][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"undefined method collect' for nil:NilClass", "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:144:infilter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:inblock in multi_filter'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:inmulti_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:44:in multi_filter'", "(eval):14343:inblock in initialize'", "org/jruby/RubyArray.java:1734:in each'", "(eval):14336:inblock in initialize'", "(eval):2872:in block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:341:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:320:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:286:inblock in start_workers'"], :thread=>"#<Thread:0x6b36f7c2 sleep>"}

Config is

    cidr {
        address => ["%{ipaddr1}"]
        network_path => "/etc/logstash/cidr.mil/pop"
        add_field => {
            "IsSystem1" => "True"
        }
    }

/etc/logstash/cidr.mil/pop File contains

10.100.0.0/16
10.100.1.0/16

Thanks

john

2

That's exactly the error you would expect if /etc/logstash/cidr.mil/pop were present, readable, and empty.

3

And that is exactly my mistake :slight_smile:

I wanted some placeholder files, for future additions.

I've added a dummy address as a placeholder in the placeholder files.

All good now !

Many thanks

4

The subnet 192.0.2.0/24 is reserved for documentation purposes, and is a good choice for such dummy addresses to ensure no accidental match with real addresses.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.