Logstash 6.0 breaks ruby event iteration

Elastic Stack Logstash
1

After upgrade to LS 6.0 following code stopped to work properly:

  ruby {
    code => "
      hash = event.to_hash
      hash.each do |k,v|
        if v == '-'
          event.remove(k)
        else
          if v.is_a? String
            v.strip!
            v.gsub!('`', ',')
          end
        end
      end
    "
  }

Following error messages are in LS logs:
[logstash.filters.ruby ] Ruby exception occurred: undefined method 'time' for "-":String

I am not calling method time and no event key is named time (there is just one time_taken field). Where is the problem?

2

This is a bug.

The workaround is to switch the LHS and RHS around.
Reasoning:
when v is the Timestamp the v == '-' is calling the ==(other) method on the Timestamp instance and this does a naive other.time without checking whether other (the String '-') is the same Class as v.
By switching them around the `==(other) call no happens on the String class and it in not so naive - it does better equality checks.
Working code:

input {
  generator {
    message => '{"fld_1": "a`b ", "fld_2": "-", "fld_3": 7}'
    count => 2
  }
}

filter {
  json {
    source => "message"
  }

  ruby {
    code => "
      hash = event.to_hash
      hash.each do |k,v|
        if '-' == v
          event.remove(k)
        else
          if v.is_a? String
            v.strip!
            v.gsub!('`', ',')
            event.set(k, v)
          end
        end
      end
    "
  }
}

output {
  stdout { codec => rubydebug }
}

NOTE: if you intend that the v.gsub!('', ',')actually modifies the event then you must set it back into the event, becausev` is not guaranteed to always be a reference to the value in the event.

3

Thanks. Is this my bug (ruby language feature) or ruby or logstash bug (so I should create a new issue)?

4

Logstash bug. Please create a new issue at https://github.com/elastic/logstash/issues

Please indicate what your old version of Logstash was - the one that the filter was known to work.

I had to modify the code to see the backtrace. I will add it to the issue after you created it.

Thanks.

5

I created following issue: https://github.com/elastic/logstash/issues/8728
The latest known working version is 5.6.0

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.