# \[ERROR\]\[logstash.filters.aggregate\]\[main\]Aggregate exception occurred {:error=\>#\<NoMethodError: undefined method \`+' for nil:NilClass\>

**URL:** <https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741>\
**Category:** Logstash\
**Created:** [June 23, 2023, 6:44am UTC](https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741 "2023-06-23T06:44:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ceyhun\_Quliyev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ceyhun_quliyev/32/108205_2.png) [@Ceyhun\_Quliyev](https://discuss.elastic.co/u/Ceyhun_Quliyev)\
**Post date:** [June 23, 2023, 6:44am UTC](https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741/1 "2023-06-23T06:44:34Z")

</div>

Dear forum members, We have encountered a problem and cannot solve it. I would be grateful if you could help us with a solution.  
Below I am providing a [link](https://gitlab.cern.ch/frontier/elk-frontier-monitoring/-/tree/jeyhun/ELK_FORUM_discussion) to the configuration file itself and the error logs.

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [June 23, 2023, 7:08am UTC](https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741/2 "2023-06-23T07:08:51Z")

</div>

Hi,

I think the logs are very clear in that case: You cannot join fields together if they do not exist (are `nil`).

There seem to be multiple different errors in the pipeline, but I took the following message as example:

> `undefined method `+' for nil:NilClass\>, :code=\>"\n map['frontieralias'] = event.get('[@metadata][frontier\_alias]');`....

The complete code seems to be:

```auto
  aggregate {
    task_id => "%{queryid}"
    code =>"
      map['frontieralias'] = event.get('[@metadata][frontier_alias]');
      map['alias_query'] = map['fullquery']+10.chr+event.get('alias_data');
      map['fullquery'] = map['alias_query']+' frontier_alias '+map['frontieralias'].to_s;
    "
    map_action => "create_or_update"
  }

```

Maybe I did not understand your pipeline completely, but I couldn't find a place where you set ` `frontier\_alias``to the map - you are only reading it so I guess this is the reason for the error.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 23, 2023, 4:25pm UTC](https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741/3 "2023-06-23T16:25:51Z")

</div>

As @Wolfram_Haussig says, you cannot append to a field in the map if it does not exist. I suspect the problem is that your log is missing some "servlet version" messages, so map['fullquery'] never gets initialized, and all the other aggregate filters that append to it get exceptions. You could try modifying every aggregate filter to include `map['fullquery'] ||= ""`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2023, 4:26pm UTC](https://discuss.elastic.co/t/error-logstash-filters-aggregate-main-aggregate-exception-occurred-error-nomethoderror-undefined-method-for-nil-nilclass/336741/4 "2023-07-21T16:26:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.