[ERROR][logstash.filters.aggregate][main]Aggregate exception occurred {:error=>#<NoMethodError: undefined method `+' for nil:NilClass>

Elastic Stack Logstash
1

Dear forum members, We have encountered a problem and cannot solve it. I would be grateful if you could help us with a solution.
Below I am providing a link to the configuration file itself and the error logs.

2

Hi,

I think the logs are very clear in that case: You cannot join fields together if they do not exist (are nil).

There seem to be multiple different errors in the pipeline, but I took the following message as example:

undefined method +' for nil:NilClass>, :code=>"\n map['frontieralias'] = event.get('[@metadata][frontier_alias]');`....

The complete code seems to be:

  aggregate {
    task_id => "%{queryid}"
    code =>"
      map['frontieralias'] = event.get('[@metadata][frontier_alias]');
      map['alias_query'] = map['fullquery']+10.chr+event.get('alias_data');
      map['fullquery'] = map['alias_query']+' frontier_alias '+map['frontieralias'].to_s;
    "
    map_action => "create_or_update"
  }

Maybe I did not understand your pipeline completely, but I couldn't find a place where you set frontier_alias``to the map - you are only reading it so I guess this is the reason for the error.

Best regards
Wolfram

3

As @Wolfram_Haussig says, you cannot append to a field in the map if it does not exist. I suspect the problem is that your log is missing some "servlet version" messages, so map['fullquery'] never gets initialized, and all the other aggregate filters that append to it get exceptions. You could try modifying every aggregate filter to include map['fullquery'] ||= "".

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.