# \[ERROR\]\[logstash.filters.ruby \] Ruby exception occur red: too few arguments : Need Help

**URL:** <https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852>\
**Category:** Logstash\
**Created:** [June 26, 2020, 12:04pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852 "2020-06-26T12:04:40Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 26, 2020, 12:04pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/1 "2020-06-26T12:04:41Z")

</div>

Hi ,

I am getting Ruby Exception too few arguments everytime I run logstash on our server . Below is the config and error msg I am trying to Parse 🙂  
Message :  
20200515T005009.898-0500 Warning Fail Connect to: ap45467 Error:No connection could be made because the target machine actively refused it [::ffff:10.178.8.144]:4747

Config :  
######################  
##Source: INPUT##  
######################  
input {  
file {  
path =\> "C:/ProgramData/QlikTech/WebServer/Log/\*.txt"  
start\_position =\> "beginning"  
ignore\_older =\> 86400  
#sincedb\_path =\> "C:/ProgramData/QlikTech/WebServer/Log/20200604.txt"  
}  
}

####################################################  
##Filter to mutate, format, convert to JSON##  
####################################################

filter {

mutate {  
gsub =\> ["message", "\n", ""]  
}  
mutate  
{  
gsub =\> ["message", "\t", " "]

}  
#pattern matching for the log.  
grok{  
match=\>{  
"message"=\>"%{GREEDYDATA:receivedTime}\t%{WORD:loglevel}\t%{GREEDYDATA:msg} %{GREEDYDATA:msg1} %{GREEDYDATA:notneeded}"  
}  
}  
#set new field to receivedTime  
mutate {  
add\_field =\> {  
"receivedTime" =\> "%{@timestamp}"  
}  
}

```
	ruby {
	        init => "require 'date'"
	        code => "event.set('receivedTime', DateTime.parse(event.get('receivedTime')).strftime('%Q').to_i)"
	    }

```

#ruby {

# code =\> "event.set('receivedTime',event.get('@timestamp').to\_i \* 1000)"

#}

#date plugin to convert timestamp =\> ISO8601

# date {

# match =\> ["receivedTime","YYYY-MM-dd HH:mm:ss", "ISO8601"]

# target =\> "@timestamp"

# }

#set field for hostname, socket to retrieve hostname  
ruby {  
init =\> "require 'socket'"  
code =\> "event.set('hostname', Socket.gethostname)"  
}

#set field for ipv4, socket for resolving hostname =\> ipv4  
ruby {  
init =\> "require 'socket'"  
code =\> "event.set('source\_ipv4', Socket.gethostname)"  
}

#dns filter plugin to resolve hostname =\> ipv4  
dns {  
failed\_cache\_size =\> "2000"  
failed\_cache\_ttl =\> "600"  
hit\_cache\_size =\> "2000"  
hit\_cache\_ttl =\> "600"  
max\_retries =\> "3"  
resolve =\> ["source\_ipv4"]  
action =\> "replace"  
timeout =\> 5  
}

#convert ipv4 =\> ip long  
ruby {  
init =\> "require 'ipaddr'"  
code =\> 'event.set("source\_ipv4",event.get("source\_ipv4").strip.split(".").map(&:to\_i).pack("CCCC").unpack("N")[0])'  
}

#mutate plugin to map column names =\> schema fields & implement nested JSON  
mutate {

```
#application object with askId, name
add_field => {
  "[application][askId]" => "xyz"
  "[application][name]" => "8989"
   }
#device object with vendor, product, hostname, ip4
add_field => {
  "[device][vendor]" => "abc"
  "[device][product]" => "Ql"
  "[device][hostname]" => "%{[hostname]}.uhc.com"
  "[device][ip4]" => "%{source_ipv4}"
}
#required fields object with logClass
add_field => {
  "logClass" => "UNCATEGORIZED"
}

```

}  
#convert ip4 =\> integer  
mutate {  
convert =\> {  
"[device][ip4]" =\> "integer"  
}  
}

#if "\_grokparsefailure" in [tags]{  
#if "Authentication failed" in [message]{

# ruby {

# code =\> 'event.set("uid",event.get("message").strip.split("'")[1].strip.split(",")[0])'

# }

```
 # mutate{
	# add_field =>{
	# "time_zone" => "CST"
	# "log_detail" => "Error"
		# "application_name" => "STARS"
		# "msg" => "Invalid Credentials %{[uid]}"
	# "date" => "%{+MM/dd/YY hh:mm:ss:ms}"
	# }

#	}

```

# }

# else{

# drop {}

#}  
#}  
#remove all unnecessary fields  
mutate {  
remove\_field =\> ["notneeded", "num", "num2", "log\_detail", "value", "log\_class", "msg2", "date", "host", "@timestamp", "application\_name", "log\_detail", "source\_ipv4", "hostname", "uid"]  
}  
}

#############################  
##Send logs to Kafka stream##  
#######################################################  
##Dev topic name: com\_eis\_dasi\_ness\_producer\_dev\_core##  
#######################################################  
output {  
if (("Error:" in [msg])){  
stdout {codec =\> json}  
file {  
path =\> "C:/Users/1234/Downloads/QlikviewLogs/events.txt"  
}  
kafka {  
bootstrap\_servers =\> "[apvrd21669.uhc.com:9093](http://apvrd21669.uhc.com:9093),[apvrd21671.uhc.com:9093](http://apvrd21671.uhc.com:9093),[apvrd22233.uhc.com:9093](http://apvrd22233.uhc.com:9093)"  
security\_protocol =\> "SSL"  
ssl\_truststore\_location =\> "C:/Users/1234/Downloads/certs/myTrustStore.jks"  
ssl\_truststore\_password =\> "smrt2020"  
topic\_id =\> "com\_eis\_dasi\_ness\_producer\_dev\_core"  
codec =\> "json"  
}  
}

}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 26, 2020, 3:08pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/2 "2020-06-26T15:08:47Z")

</div>

What is the complete error message?

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 26, 2020, 3:22pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/3 "2020-06-26T15:22:06Z")

</div>

[2020-06-23T06:48:31,556][INFO][logstash.agent] Successfully started  
Logstash API endpoint {:port=\>9600}  
[2020-06-23T06:48:35,596][ERROR][logstash.filters.ruby] Ruby exception occur  
red: too few arguments

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 26, 2020, 3:34pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/4 "2020-06-26T15:34:09Z")

</div>

Is there no stacktrace?

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 26, 2020, 3:52pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/5 "2020-06-26T15:52:49Z")

</div>

no , I am guessing some issue in my message parsing incase if \t in my grok pattern causing the exception ? Not sure though but its coming from filter block of code

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 26, 2020, 4:03pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/6 "2020-06-26T16:03:34Z")

</div>

> [@upasana\_sarangi](#):
>
> [ERROR][logstash.filters.ruby]

The problem is not in the grok filter, it is in one of the ruby filters. I would try commenting them all out then adding them back one at a time to see which one results in an exception.

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 26, 2020, 4:27pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/7 "2020-06-26T16:27:03Z")

</div>

Ok will give it a try and let u know

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 29, 2020, 2:00pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/8 "2020-06-29T14:00:04Z")

</div>

started commenting out all ruby blocks one by one , got exception when this part of Ruby code was included :

#convert ipv4 =\> ip long  
ruby {  
init =\> "require 'ipaddr'"  
code =\> 'event.set("source\_ipv4",event.get("source\_ipv4").strip.split(".").map(&:to\_i).pack("CCCC").unpack("N")[0])'  
}

FYI , I had not ot any execption in my local but I do get this exception on our stage servers . Kindly help as I am completely new to this area

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 29, 2020, 3:39pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/9 "2020-06-29T15:39:25Z")

</div>

> [@upasana\_sarangi](#):
>
> .map(&:to\_i)

What do you expect that to do?

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 29, 2020, 3:47pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/10 "2020-06-29T15:47:35Z")

</div>

not sure , we were just given a template to add our details for logging and compliance . Not sure what it does , it can be ignored if not needed.

---

<div class="post-metadata">

**Author:** ![upasana\_sarangi](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@upasana\_sarangi](https://discuss.elastic.co/u/upasana_sarangi)\
**Post date:** [June 30, 2020, 11:29am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/11 "2020-06-30T11:29:13Z")

</div>

Seems like our server is having ipV6 so its not working any replacement code for ipv6 will work

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 30, 2020, 4:44pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/12 "2020-06-30T16:44:12Z")

</div>

> [@upasana\_sarangi](#):
>
> event.set("source\_ipv4",event.get("source\_ipv4").strip.split(".").map(&:to\_i).pack("CCCC").unpack("N")[0])

Code like

```
event.get("source_ipv4").strip.split(".").map { |x| x.to_i }.pack("CCCC").unpack("N")

```

will take apart the 4 octets of an IPv4 address and then pack them into a 32-bit number. IPv4 addresses are 32-bits, so this is a good fit.

IPv6 addresses are 128-bits. How do expect to represent that as a number?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 4:44pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occur-red-too-few-arguments-need-help/238852/13 "2020-07-28T16:44:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.