'less/greater than or equal to' forgotten?

Elastic Stack Logstash
1

A first issue here: https://github.com/elastic/logstash/issues/6652
After update to logstash-5.1.2 now the question here.

Config File:

filter {
    if [score] >= 10 { mutate { ... } }
}

Sample Data:

{"@timestamp":"2017-02-07T16:38:21.767Z","score":20.0}

logstash-plain.log

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<NoMethodError: undefined method `>=' for nil:NilClass>, ...

The log shows undefined method '>=' but I see 'equality' in documentation here
https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals
and a example here

2

I ran a simple test to see if I could replicate what you're seeing:

input { stdin { } }

filter {
  mutate { add_field => { "score" => "20.0" } }
  mutate { convert => { "score" => "float" } }
  if [score] >= 10 { 
    mutate { add_field => { "greater" => "yes" } } 
  }
  else { 
    mutate { add_field => { "greater" => "no" } } 
  }
}

output { stdout { codec => rubydebug } }

This simply adds a field called score and sets it to "20.0" (a string). It then mutates it into a float value.

It does a comparison to see if [score] >= 10, and adds the field greater with the value of "yes" if it is (and 20 is definitely greater than 10), and "no" if it isn't. This is the output I got:

17:45:58.595 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9602}
asdf
{
         "score" => 20.0,
    "@timestamp" => 2017-02-08T00:46:02.189Z,
      "@version" => "1",
          "host" => "logstash",
       "message" => "asdf",
       "greater" => "yes"
}

As you can see, the asdf I typed is message, and the other fields were added and the >= test worked as expected.

The question is why you're seeing something different. It's hard to guess, since the error posted to the issue is truncated. It will give that error if you try to compare a string to an integer (and it will say so in the full error).

I know in your JSON there that score is a numeric value, but does Logstash see it as such?

3

Here's the important part of the error message:

NoMethodError: undefined method `>=' for nil:NilClass

This indicates that the event didn't have a score field.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.