Logstash 6.0 breaks ruby code if running more than 1 worker

I upgraded Logstash to 6.0. After the upgrade a lot of ruby code stopped to work. Following code worked in Logstash 5, but in Logstash 6 it ofter causes these errors:
Ruby exception occurred: org.jruby.RubyNil cannot be cast to org.jruby.RubyMatchData


  # fixes JSON before processing in LS and indexing in ES ...
  # lowercase json keys, replace invalid characters in json keys, in case of object value, add _o suffix to json keys
  ruby {
    code => '
      nlog_str_inarr = event.get("json_message").split("")
      nlog_str_outarr = []
      nlog_str_outarr_buff = []
      nlog_str_outarr_buffenabled = false
      nlog_key_prefixmatch = [ "", "", "" ]
      nlog_inside_key = false
      nlog_str_inarr.each { |c|
        if c !~ /^\s$/
          nlog_key_prefixmatch[0] = nlog_key_prefixmatch[1]
          nlog_key_prefixmatch[1] = nlog_key_prefixmatch[2]
          nlog_key_prefixmatch[2] = c
        # detect key values
        if ! nlog_inside_key
          if nlog_key_prefixmatch[2] == "\"" && (nlog_key_prefixmatch[1] == "{" || nlog_key_prefixmatch[1] == "," || nlog_key_prefixmatch[1] == "")
            nlog_inside_key = true
          if nlog_key_prefixmatch[2] == "\"" && nlog_key_prefixmatch[1] != "\\"
            nlog_inside_key = false
            nlog_str_outarr_buffenabled = true
            if c !~ /^[a-zA-Z0-9_-]$/
              c = "_"
        if ! nlog_str_outarr_buffenabled
          # buffering until reach the value, after that determine if the value is object and in this case add to the key "_o" suffix
          if nlog_key_prefixmatch[1] == ":"
            if nlog_key_prefixmatch[2] == "{"
            nlog_str_outarr_buff.each { |bc|
            nlog_str_outarr_buff = []
            nlog_str_outarr_buffenabled = false
      event.set("json_message_parsed", nlog_str_outarr.join())

Am I doing something wrong? Why is this code not running in LS 6.0 with more than 1 worker? Is that a ruby bug?

It is not a Ruby bug, its a bug in Logstash.

Please file an issue in https://github.com/elastic/logstash/issues
Please add the info you have here plus the full error stacktrace. You should label the issue with v6.0.0

I created issue https://github.com/elastic/logstash/issues/8727, I have no permission to set any label on it.

Ok. Thanks, I added the label just now. :slight_smile:

As MatchData is associated with regular expressions, as an attempted workaround, you might like to try reversing the regex tests - its valid ruby to do so.

if /^\s$/ !~ c


if  /^[a-zA-Z0-9_-]$/ !~ c

Post back here if that helps.

Also are you able to patch the ruby filter code to get it to print the backtrace with the error?
The file is here:
Find line 46 and change it to:

@logger.error("Ruby exception occurred", "exception" => e.message, "backtrace" => e.backtrace)

If you decide to do this, please add the backtrace and your full config to the issue.
I'm not sure we can recreate the bug without sufficient sample data i.e. enough for two batches so multiple workers will actually invoke the ruby filter.

Reversing the regex did not help.
I modified the ruby.rb and added the trace to the https://github.com/elastic/logstash/issues/8727 comment,
What configuration files do you need - logstash.yml or full pipeline conf files? Pipeline contains multiple config files (15 filters) and some configuration contain confidental information. Also the sample data is confidental - I could provide one anonymized input message but probably it would not be very helpful.

1 Like

I can recreate the bug - no need for more info from you.

Thanks for the bug report.


See my comment - https://github.com/elastic/logstash/issues/8727#issuecomment-347225889

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.