[ERROR] Ruby exception occurred: undefined method `+' for nil:NilClass

Hi everyone, I have a problem with a filter in ruby, I am doing an operation between 2 metrics, but I get the following error:

[ERROR] 2021-06-29 14:02:24.847 [[main]>worker0] ruby - Ruby exception occurred: undefined method `+' for nil:NilClass

This is my logstash configuration:

input {
  snmp {
    get => ["1.3.6.1.4.1.2620.1.1.25.3.0", "1.3.6.1.4.1.2620.1.6.7.2.4.0", "1.3.6.1.4.1.2620.1.6.7.4.3.0", "1.3.6.1.4.1.2620.1.6.7.4.4.0"]
    walk => ["1.3.6.1.4.1.2620.1.6.7.6.1.8", "1.3.6.1.4.1.2620.1.6.7.8.1.1.3", "1.3.6.1.4.1.2620.1.1.25.5.1.7.3","1.3.6.1.4.1.2620.1.1.25.5.1.8.3"]
    walk => ["1.3.6.1.4.1.2620.1.5.5", "1.3.6.1.4.1.2620.1.5.6"]
    hosts => [{host => "udp:172.28.110.2/161" community => "efec3t1v0" version => "2c"}]
    interval => 60
       }
     }

filter {
 if [host] == "172.28.110.2" {
    mutate { add_field => {"State" => 0}}
  mutate {
        add_field => {"Sysname" => "VS_Med_Core2"}
        convert => {
                        "SystemTemp1" => "integer"
                        "SystemTemp2" => "integer"
                        "SystemTemp3" => "integer"
                        "CPU Temp" => "integer"
                        "CPU PECI Temp" => "integer"
                     }
convert => { "State" => "integer" }
convert => {"R" => "integer"}
convert => {"MemoriaUsadaTotal" => "integer"}
convert => {"Temptotal" => "integer"}
  rename => ["host", "IP"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.3.0", "Conexiones"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.2.4.0", "CPU"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.4.0", "RAMUsage"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.3.0", "RAMTotal"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.1.0", "/"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.2.0", "/boot"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.3.0", "/var/log"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.1.0", "SystemTemp1"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.2.0", "SystemTemp2"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.3.0", "SystemTemp3"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.4.0", "CPU Temp"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.5.0", "CPU PECI Temp"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.5.1.7.3.0", "In"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.5.1.8.3.0", "Out"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.5.5.0", "Started"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.5.6.0", "ClusterState"]
  }
ruby {
    code => "event.set('Temptotal', event.get('SystemTemp1') + event.get('SystemTemp2'))"
  }
  ruby {
      code => "event.set('R', event.get('RAMUsage') * 100)"
  }
  ruby {
        code => "event.set('MemoriaUsadaTotal', event.get('R') / event.get('RAMTotal'))"
   }
  }
}

output {
stdout {}
}

Both ruby filters work, the one with the problem is this one:

ruby {
    code => "event.set('Temptotal', event.get('SystemTemp1') + event.get('SystemTemp2'))"
  }

If the [SystemTemp1] field does not exist then event.get will return nil and you will get exactly that exception. You need to verify that the fields exist before trying to use them. You could do either

if [SystemTemp1] and [SystemTemp2] {
    ruby { code => "event.set('Temptotal', event.get('SystemTemp1') + event.get('SystemTemp2'))" }
}

or

ruby {
    code => '
        t1 = event.get("SystemTemp1")
        t2 = event.get("SystemTemp2")
        if t1 && t2
            event.set("Temptotal", t1 + t2)
        end
    '
}

yes, the field exists in the mutate :

filter {
 if [host] == "172.28.110.2" {
    mutate { add_field => {"State" => 0}}
  mutate {
        add_field => {"Sysname" => "VS_Med_Core2"}
        convert => {
                        "SystemTemp1" => "integer"
                        "SystemTemp2" => "integer"
                        "SystemTemp3" => "integer"
                        "CPU Temp" => "integer"
                        "CPU PECI Temp" => "integer"
                     }
convert => { "State" => "integer" }
convert => {"R" => "integer"}
convert => {"MemoriaUsadaTotal" => "integer"}
convert => {"Temptotal" => "integer"}
  rename => ["host", "IP"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.3.0", "Conexiones"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.2.4.0", "CPU"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.4.0", "RAMUsage"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.3.0", "RAMTotal"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.1.0", "/"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.2.0", "/boot"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.3.0", "/var/log"]

this is...

 rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.1.0", "SystemTemp1"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.2.0", "SystemTemp2"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.3.0", "SystemTemp3"]

I have done it, but the field does not appear.

[INFO ] 2021-06-29 14:23:38.753 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[INFO ] 2021-06-29 14:23:38.832 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
                  "CPU" => 1,
             "/var/log" => 96,
           "Conexiones" => 6517,
    "MemoriaUsadaTotal" => 15,
                  "Out" => 14827080,
             "RAMTotal" => 66516443136,
                    "R" => 1021215129600,
           "@timestamp" => 2021-06-29T18:23:39.036Z,
                   "In" => 10779964,
                "State" => 0,
         "ClusterState" => "active",
                   "IP" => "172.28.110.2",
             "RAMUsage" => 10212151296,
              "Started" => "yes",
                "/boot" => 68,
              "Sysname" => "VS_Med_Core2",
             "@version" => "1",
                    "/" => 70
}
^C[WARN ] 2021-06-29 14:23:43.574 [SIGINT handler] runner - SIGINT received. Shutting down.
^C[FATAL] 2021-06-29 14:23:43.792 [SIGINT handler] runner - SIGINT received. Terminating immediately..
[FATAL] 2021-06-29 14:23:43.808 [LogStash::Runner] Logstash -
org.jruby.exceptions.ThreadKill: null
filter {
 if [host] == "172.28.110.2" {
    mutate { add_field => {"State" => 0}}
  mutate {
        add_field => {"Sysname" => "VS_Med_Core2"}
        convert => {
                        "SystemTemp1" => "integer"
                        "SystemTemp2" => "integer"
                        "SystemTemp3" => "integer"
                        "CPU Temp" => "integer"
                        "CPU PECI Temp" => "integer"
                     }
convert => { "State" => "integer" }
convert => {"R" => "integer"}
convert => {"MemoriaUsadaTotal" => "integer"}
convert => {"Temptotal" => "integer"}
  rename => ["host", "IP"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.3.0", "Conexiones"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.2.4.0", "CPU"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.4.0", "RAMUsage"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.4.3.0", "RAMTotal"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.1.0", "/"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.2.0", "/boot"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.6.1.8.3.0", "/var/log"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.1.0", "SystemTemp1"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.2.0", "SystemTemp2"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.3.0", "SystemTemp3"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.4.0", "CPU Temp"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.6.7.8.1.1.3.5.0", "CPU PECI Temp"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.5.1.7.3.0", "In"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.1.25.5.1.8.3.0", "Out"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.5.5.0", "Started"]
  rename => ["iso.org.dod.internet.private.enterprises.2620.1.5.6.0", "ClusterState"]
  }
ruby {
    code => '
        t1 = event.get("SystemTemp1")
        t2 = event.get("SystemTemp2")
        if t1 && t2
            event.set("Temptotal", t1 + t2)
        end
    '
}
  ruby {
      code => "event.set('R', event.get('RAMUsage') * 100)"
  }
  ruby {
        code => "event.set('MemoriaUsadaTotal', event.get('R') / event.get('RAMTotal'))"
   }
  }
}

sorry , already worked thank you :smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.