# Issues with processing wrong input by logstash-filter-oui

**URL:** <https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719>\
**Category:** Logstash\
**Created:** [July 4, 2017, 6:58am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719 "2017-07-04T06:58:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![okazymyrov](https://avatars.discourse-cdn.com/v4/letter/o/bc79bd/32.png) [@okazymyrov](https://discuss.elastic.co/u/okazymyrov)\
**Post date:** [July 4, 2017, 6:58am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719/1 "2017-07-04T06:58:01Z")

</div>

Hello,

I get an input from a 3rd-party program. The input data might be corrupted, for example:

> 1C:1D:86:41:3C:80  
> 24:DE:C6:56:17-07-03 07:49:42  
> 24:DE:C6:56:CB:C0

As a result, logstash crashes because of logstash-filter-oui-3.0.1:

> [2017 - 07 - 04T08: 38: 01, 587][ERROR][logstash.pipeline]Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.{  
> "exception" =\> "undefined method `strip' for nil:NilClass", "backtrace" => ["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in `to\_i'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in `find'", "/usr/share/logstash/vendor/jruby/lib/ruby/1.9/monitor.rb:211:in `mon\_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in `find'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi\_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:43:in `multi_filter'", "(eval):3528:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):3520:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):843:in `filter\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in `filter_batch'", "org/jruby/RubyProc.java:281:in `call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:224:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:223:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:369:in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in `start\_workers'"]  
> }

> [2017 - 07 - 04T08: 38: 01, 720][FATAL][logstash.runner]An unexpected error occurred!{  
> : error =\> # \< NoMethodError: undefined method `strip' for nil:NilClass>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in ` to\_i '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in `find' ", " / usr / share / logstash / vendor / jruby / lib / ruby / 1.9 / monitor.rb: 211: in `mon\_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in `find '", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.1-java/lib/logstash/filters/oui.rb:33:in`filter' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 145: in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in ` multi\_filter '", "org/jruby/RubyArray.java:1613:in `each' ", " / usr / share / logstash / logstash - core / lib / logstash / filters / base.rb: 161: in `multi\_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:43:in `multi_filter '", "(eval):3528:in`initialize' ", " org / jruby / RubyArray.java: 1613: in `each'", "(eval):3520:in ` initialize '", "org/jruby/RubyProc.java:281:in `call' ", "(eval): 843: in `filter\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:370:in `filter_batch '", "org/jruby/RubyProc.java:281:in`call' ", " / usr / share / logstash / logstash - core / lib / logstash / util / wrapped\_synchronous\_queue.rb: 224: in `each'", "org/jruby/RubyHash.java:1342:in ` each '", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:223:in `each' ", " / usr / share / logstash / logstash - core / lib / logstash / pipeline.rb: 369: in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:350:in `worker_loop '", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:317:in`start\_workers' "]}  
> ├

I assume that the issue must be handled by the plugin instead of generating the error.

Kind regards,  
Oleksandr

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 4, 2017, 7:15am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719/2 "2017-07-04T07:15:09Z")

</div>

Perhaps you can use a conditional to avoid sending events through the oui filter if it's corrupted? Hard to be specific without knowing what your configuration looks like.

If there isn't already an GitHub issue filed for the oui plugin, please file one.

---

<div class="post-metadata">

**Author:** ![okazymyrov](https://avatars.discourse-cdn.com/v4/letter/o/bc79bd/32.png) [@okazymyrov](https://discuss.elastic.co/u/okazymyrov)\
**Post date:** [July 4, 2017, 8:22am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719/3 "2017-07-04T08:22:13Z")

</div>

Regex works fine, but it is an additional check for every event. I have reported [the issue](https://github.com/logstash-plugins/logstash-filter-oui/issues/6) (with the config file triggering the error) on GitHub.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2017, 8:22am UTC](https://discuss.elastic.co/t/issues-with-processing-wrong-input-by-logstash-filter-oui/91719/4 "2017-08-01T08:22:49Z")

</div>

Closed on August 1, 2017, 8:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.