Error converting to IP type


(Javier Torres) #1

Hello,
In trying to use the IP field type and in doing so I am seeing a strange error in the logstash logs.

I am running with version 1.4.5

the portion of the config that is causing the error to be thrown is as follows:
mutate {
convert => [ "Bytes", "integer" ]
convert => [ "BytesReceived", "integer" ]
convert => [ "BytesSent", "integer" ]
convert => [ "ElapsedTimeInSec", "integer" ]
convert => [ "geoip.area_code", "integer" ]
convert => [ "geoip.dma_code", "integer" ]
convert => [ "geoip.latitude", "float" ]
convert => [ "geoip.longitude", "float" ]
convert => [ "NATDestinationPort", "integer" ]
convert => [ "NATSourcePort", "integer" ]
convert => [ "Packets", "integer" ]
convert => [ "pkts_received", "integer" ]
convert => [ "pkts_sent", "integer" ]
convert => [ "seqno", "integer" ]
gsub => [ "Rule", " ", "",
"Application", "( |-)", "
" ]
remove_field => [ "message", "raw_message" ]
add_field => [ "clientip", "%{DestinationAddress}" ]
convert =>["clientip","IP"]
}

Error is:
{:timestamp=>"2015-10-06T12:44:04.476000-0400", :message=>"+---------------------------------------------------------+\n| An unexpected error occurred. This is probably a bug. |\n| You can find help with this problem in a few places: |\n| |\n| * chat: #logstash IRC channel on freenode irc. |\n| IRC via the web: http://goo.gl/TI4Ro |\n| * email: logstash-users@googlegroups.com |\n| * bug system: https://logstash.jira.com/ |\n| |\n+---------------------------------------------------------+\nThe error reported is: \n undefined local variable or method `valid_types' for #LogStash::Filters::Mutate:0x4dcf319"}

Looking to see if anyone has seen this or has a work around?

Thanks,
Javier


(Magnus B├Ąck) #2

"IP" isn't a Logstash type but an Elasticsearch type. You'll pass the IP address to ES as a string and ES will parse the IP address and store it accordingly if that field is mapped as having the type "ip". This is controlled by the index template.


(Javier Torres) #3

Thanks,
Strange I have been passing it that way and its not working how I thought it might when I was trying to do the tile map setup. I will go back and see what else might be wrong. Thanks for the quick response.

Javier


(system) #4