# Handle filter exception in Logstash

**URL:** <https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623>\
**Category:** Logstash\
**Created:** [October 9, 2018, 12:02pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623 "2018-10-09T12:02:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adrianolimit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianolimit/32/11930_2.png) [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\
**Post date:** [October 9, 2018, 12:02pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623/1 "2018-10-09T12:02:41Z")

</div>

Hello elasticusers,

I have a question about exceptions in the filter part of Logstash.

This is my config file (I don't describe the "intput" and "output" parts) :

> ```
> input {
> file{}
> }
> filter {
> csv { ...}
> grok {...}
> date{...}
> ruby{...}
> }
> output {
> elasticsearch {}
> }
> 
> ```

Is it possible to handle exceptions generated by filters (csv, ruby...)?

I can apply a statement like this :

> if "\_csvparsefailure" in [tags] {  
> ...  
> }

But I want to extract the exception message in this case, for example :  
\__":exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>"._

Is it possible to catch this exception message in order to output it to the file?

> ```
> output {
> file {
> path => "/path_to_my_file/filter_error.log"
> codec => line {
> format => "%{message} | %{exception_filter_expected}"
> }
> }
> }
> 
> ```

Used version : Logstash 6.3.0

Thank you in advance for your help.

---

<div class="post-metadata">

**Author:** ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)\
**Post date:** [October 9, 2018, 1:37pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623/2 "2018-10-09T13:37:57Z")

</div>

I think you can handle it in the ruby filter (with the ruby exception mechanism) but for the other ones, I have no idea (except rewrite them with the ruby filter).

---

<div class="post-metadata">

**Author:** ![adrianolimit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianolimit/32/11930_2.png) [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\
**Post date:** [October 9, 2018, 2:53pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623/3 "2018-10-09T14:53:33Z")

</div>

Do you think is it possible to handle exceptions from other filters (csc,grok,...) in ruby filter?

---

<div class="post-metadata">

**Author:** ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)\
**Post date:** [October 9, 2018, 2:59pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623/4 "2018-10-09T14:59:39Z")

</div>

No I don't ... 😬

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2018, 2:59pm UTC](https://discuss.elastic.co/t/handle-filter-exception-in-logstash/151623/5 "2018-11-06T14:59:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.