CIDR filter network_path error

Hi,

logstash-6.5.3-1.noarch on RHEL

I get the following error when using the cidr filter with network_path

[2019-02-23T21:30:16,297][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"undefined method collect' for nil:NilClass", "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:144:infilter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:inblock in multi_filter'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:inmulti_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:44:in multi_filter'", "(eval):14343:inblock in initialize'", "org/jruby/RubyArray.java:1734:in each'", "(eval):14336:inblock in initialize'", "(eval):2872:in block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:341:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:320:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:286:inblock in start_workers'"], :thread=>"#<Thread:0x6b36f7c2 sleep>"}

Config is

    cidr {
        address => ["%{ipaddr1}"]
        network_path => "/etc/logstash/cidr.mil/pop"
        add_field => {
            "IsSystem1" => "True"
        }
    }

/etc/logstash/cidr.mil/pop File contains

10.100.0.0/16
10.100.1.0/16

Thanks

john

That's exactly the error you would expect if /etc/logstash/cidr.mil/pop were present, readable, and empty.

And that is exactly my mistake :slight_smile:

I wanted some placeholder files, for future additions.

I've added a dummy address as a placeholder in the placeholder files.

All good now !

Many thanks

The subnet 192.0.2.0/24 is reserved for documentation purposes, and is a good choice for such dummy addresses to ensure no accidental match with real addresses.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.