ERROR - Cloudwatch Output plugin - Direct event field references have been disabled

[CliveL (Clive Lawrence)]

Hi,

I have been trying to use the Cloudwatch Output plugin in both Logstash 5.0.1 and 5.1.1 and when I set the Cloudwatch Output to DEBUG I see the following lines when it attempts to set a metric:

[2017-01-11T12:41:21,953][DEBUG][logstash.outputs.cloudwatch] Queueing event {:event=>2017-01-11T12:41:19.333Z msggw-api-1 %{message}}
[2017-01-11T12:41:23,871][DEBUG][logstash.outputs.cloudwatch] Scheduler Activated
[2017-01-11T12:41:23,872][DEBUG][logstash.outputs.cloudwatch] QUEUE SIZE {:queuesize=>1}
[2017-01-11T12:41:23,873][WARN ][logstash.outputs.cloudwatch] Exception! Breaking count loop {:exception=># NoMethodError: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.>}

I think this is related to using a "nested field" as the source of the metric value, although when I use a top-level field I still get the same error in the logs, so this may just be a version incompatibility? I have checked that I am running the latest update of the plugin in both LS 5.0.1 and 5.1.1.

I have set the CW_dimensions, CW_namespace and CW_metricname fields using the Mutate filter. I am trying to set the Value field in the Cloudwatch Output filter config as follows:

field_value => "[@fields][resp_time][value]"

This is the nested location of the field containing the number type that I wanted to be injected into a custom Cloudwatch metric.

Is anyone able to confirm if this is bug in the plugin, or my config?

Many thanks!

[CliveL (Clive Lawrence)]

I've looked further into this issue today and modified the plugin Ruby file to be compatible with the new Event API changes that were introduced in Logstash 5.0. My fork of the plugin is now working and I've issued a Pull Request for the project. I'll close this issue here...