Could not load : can't convert nil into String

Elastic Stack Logstash
1

When I use

output {
      stdout { codec => rubydebug }
    }

I end up filling up my logs files with the following.

Could not load : can't convert nil into String

My configuration is as follows.


Grok Pattern File

CISCOTIMESTAMPTZ %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} %{TZ}

If I run without rubydebug I end up getting a grok parse failure on all of my IOS logs.

Any help would be appreciated. I am running logstash-5.4.0-1.

2

Please show the full error message (and maybe with some preceding lines for context).

3

This is literally the whole message.

Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String
Could not load : can't convert nil into String

If you can recommend elsewhere to look I will be happy to pull any and all logs needed.

4

I will restart in debug and see if I cannot get some more detail.

5

Sorry no additional detail with debug on.

6

What is fairly confusing to me is why it would happen once rubydebug is enabled and why I cannot process IOS(Cisco) logs without it. The rest of my logs are processed without issue and that is around 120K per minute. Any ideas?

7

I was able to distill my config down into the following and am still receiving the error. Any help would be appreciated.

input {
  beats {
    port     => 5044
    ssl      => false
  }
}
output {
  elasticsearch {
    hosts           => ['xxxxxxxxxxxxxx:9200','xxxxxxxxxxxxxx:9200']
    sniffing        => true
    manage_template => false
    index           => "filebeat-%{+YYYY.MM.dd}"
    document_type   => "%{[@metadata][type]}"
  }
  
  stdout { codec => rubydebug }
}
8

I'm pretty sure it's a Logstash bug (either in the core or in one of the plugins). I think it has come up before but I wasn't able to find a GitHub issue for it.

9

Thank Magnus. I have seen some of the bugs also and would agree. I will create a bug issue for the problem. I believe the issue is with awesome_print.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.