# \[ERROR\] logstash.filters.ruby
**URL:** https://discuss.elastic.co/t/error-logstash-filters-ruby/291841
**Category:** Logstash
**Created:** [December 14, 2021, 4:46pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841 "2021-12-14T16:46:52Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@kyk](https://discuss.elastic.co/u/kyk)
#### Post date: [December 14, 2021, 4:46pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/1 "2021-12-14T16:46:52Z")
I have the next ruby code
ruby {
code =\> '
m = event.get("ip\_port").scan(/(\d+.\d+.\d+.\d+):(\d+)-\>(\d+.\d+.\d+.\d+):(\d+)/)
w = ; x = ; y = ; z =
m.each { |a|
w \<\< a[0].to\_fo
x \<\< a[1].to\_fo
y \<\< a[2].to\_fo
z \<\< a[3].to\_fo
}
event.set("ip\_source", w)
event.set("port\_source", x)
event.set("ip\_dest", y)
event.set("port\_dest", z)
'
}
And when I'm starting logstash, I have the next error
[2021-12-14T11:41:21,638][ERROR][logstash.filters.ruby][main][30b39e8ec7a579953c0bbedb55fc148d9456eb0655c801b2bb6f8d7595851567] Ruby exception occurred: undefined method `scan' for nil:NilClass {:class=>"NoMethodError", :backtrace=>["(ruby filter code):3:in `block in filter\_method'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:93:in `inline_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:86:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi\_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi\_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start\_workers'"]}
Could you help me to fix the error?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 14, 2021, 5:39pm UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/2 "2021-12-14T17:39:22Z")
> [@kyk](#):
>
> undefined method `scan' for nil:NilClass`
That is telling you that event.get("ip\_port") returned nil, which means there was an event that does not have an [ip\_port] field. You should test whether it is nil before using it
```
port = event.get("ip_port")
if port
port.scan ....
end
```
---
### Author:  [@kyk](https://discuss.elastic.co/u/kyk)
#### Post date: [December 29, 2021, 2:53am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/3 "2021-12-29T02:53:53Z")
OK, this was a problem. Thanks
---
### Author:  [@kyk](https://discuss.elastic.co/u/kyk)
#### Post date: [December 29, 2021, 3:10am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/4 "2021-12-29T03:10:30Z")
Now, I have other problem. The ruby session run without problem but the result is not correct. For example:
**Field:**
ip\_port: "10.10.0.1:2526-\>20.20.0.1:80; 11.11.0.2:3437-\>20.20.0.1:80"
**Filter:**
ruby {
code =\> '
m = event.get("ip\_port").scan(/(\d+.\d+.\d+.\d+):(\d+)-\>(\d+.\d+.\d+.\d+):(\d+)/)
w = ; x = ; y = ; z =
m.each { |a|
w \<\< a[0].to\_fo
x \<\< a[1].to\_fo
y \<\< a[2].to\_fo
z \<\< a[3].to\_fo
}
event.set("ip\_source", w)
event.set("port\_source", x)
event.set("ip\_dest", y)
event.set("port\_dest", z)
'
}
**Result:**
ip\_source: 10.10, 11.11
port\_source: 2526.0, 3437.0
ip\_dest: 20.20, 20.20
port\_dest: 80.0, 80.0
The result is not correct
Could you help me to fix the error?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 29, 2021, 3:14am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/5 "2021-12-29T03:14:16Z")
Can you ask that as a new question? Also, you need to use markdown to make it readable.
I will take a look in the morning.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 26, 2022, 3:15am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841/6 "2022-01-26T03:15:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.