I upgraded Logstash to 6.0. After the upgrade a lot of ruby code stopped to work. Following code worked in Logstash 5, but in Logstash 6 it ofter causes these errors:
Ruby exception occurred: org.jruby.RubyNil cannot be cast to org.jruby.RubyMatchData
Code:
# fixes JSON before processing in LS and indexing in ES ...
# lowercase json keys, replace invalid characters in json keys, in case of object value, add _o suffix to json keys
ruby {
code => '
nlog_str_inarr = event.get("json_message").split("")
nlog_str_outarr = []
nlog_str_outarr_buff = []
nlog_str_outarr_buffenabled = false
nlog_key_prefixmatch = [ "", "", "" ]
nlog_inside_key = false
nlog_str_inarr.each { |c|
if c !~ /^\s$/
nlog_key_prefixmatch[0] = nlog_key_prefixmatch[1]
nlog_key_prefixmatch[1] = nlog_key_prefixmatch[2]
nlog_key_prefixmatch[2] = c
end
# detect key values
if ! nlog_inside_key
if nlog_key_prefixmatch[2] == "\"" && (nlog_key_prefixmatch[1] == "{" || nlog_key_prefixmatch[1] == "," || nlog_key_prefixmatch[1] == "")
nlog_inside_key = true
end
else
if nlog_key_prefixmatch[2] == "\"" && nlog_key_prefixmatch[1] != "\\"
nlog_inside_key = false
nlog_str_outarr_buffenabled = true
else
c.downcase!
if c !~ /^[a-zA-Z0-9_-]$/
c = "_"
end
end
end
if ! nlog_str_outarr_buffenabled
nlog_str_outarr.push(c)
else
# buffering until reach the value, after that determine if the value is object and in this case add to the key "_o" suffix
nlog_str_outarr_buff.push(c)
if nlog_key_prefixmatch[1] == ":"
if nlog_key_prefixmatch[2] == "{"
nlog_str_outarr.push("_o")
end
nlog_str_outarr_buff.each { |bc|
nlog_str_outarr.push(bc)
}
nlog_str_outarr_buff = []
nlog_str_outarr_buffenabled = false
end
end
}
event.set("json_message_parsed", nlog_str_outarr.join())
'
}
Am I doing something wrong? Why is this code not running in LS 6.0 with more than 1 worker? Is that a ruby bug?
