# Logstash "Age" Filter Plugin **URL:** https://discuss.elastic.co/t/logstash-age-filter-plugin/84602 **Category:** Logstash **Created:** [May 4, 2017, 5:53pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602 "2017-05-04T17:53:45Z") **Posts on this page:** 8 **Page:** 1
### Author: ![bt3388](https://avatars.discourse-cdn.com/v4/letter/b/a183cd/32.png) [@bt3388](https://discuss.elastic.co/u/bt3388) #### Post date: [May 4, 2017, 5:53pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/1 "2017-05-04T17:53:45Z")
I am hoping to get some help getting the age plugin to work. It seems like a really new filter plugin without a log of documentation. - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-age.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-age.html) Here is my code ```auto age {} if [Timestamp][age] > 259200 { drop {} } ``` I am trying to drop log events older than 3 days old. "Timestamp" is a grok parsed timestamp field from the incoming log in ISO8601 format. I have not been able to get the .conf to load without configuration errors. I know it works without the "age" code. Errors ```auto [2017-05-04T11:41:38,422][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#' for nil:NilClass>, "backtrace"=>["(eval):824:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):822:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):434:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:378:in `filter_batch'", "org/jruby/RubyProc.java:281:in `call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:201:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:200:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:377:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:365:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:331:in `start_workers'"]} ``` ```auto [2017-05-04T11:41:38,570][FATAL][logstash.runner] An unexpected error occurred! {:error=>#' for nil:NilClass>, :backtrace=>["(eval):824:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):822:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):434:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:378:in `filter_batch'", "org/jruby/RubyProc.java:281:in `call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:201:in `each'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:200:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:377:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:365:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:331:in `start_workers'"]} ``` ![](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8439b98a6ff4e9be919a0ddc77706a073079efb.PNG) ![](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73fab4d20c2293884ea162d511d345763bb215d8.PNG) It seems like some sort of Ruby error. I have the Ruby plugin installed but its not part of my .conf file. The Age documentation does not specify any ruby dependencies that need to be included in filter. Any help greatly appreciate! Thanks, Ben ---
### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek) #### Post date: [May 4, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/2 "2017-05-04T18:51:04Z")
Please don't paste screenshots. They're just too hard to read. Please include the actual text of the error between lines of triple back-ticks, like this: ```` ``` PASTE ERRORS HERE ``` ```` We'll see the code in a much more readable fashion. ---
### Author: ![bt3388](https://avatars.discourse-cdn.com/v4/letter/b/a183cd/32.png) [@bt3388](https://discuss.elastic.co/u/bt3388) #### Post date: [May 4, 2017, 8:16pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/3 "2017-05-04T20:16:50Z")
my bad! fixed! ---
### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck) #### Post date: [May 5, 2017, 5:14am UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/4 "2017-05-05T05:14:00Z")
By default the age filter stores the age of the event in the `[@metadata][age]` field. If you want it in `[Timestamp][age]` you need to configure the age filter accordingly. ---
### Author: ![bt3388](https://avatars.discourse-cdn.com/v4/letter/b/a183cd/32.png) [@bt3388](https://discuss.elastic.co/u/bt3388) #### Post date: [May 5, 2017, 3:53pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/5 "2017-05-05T15:53:31Z")
Hmm what do you mean by configure the age filter accordingly? Does that mean the "Timestamp" variable needs to be defined in there not in a grok filter? I was confused by what @metadata was referring to. [@metadata][age] refer to two different variables being compared right? age being the variable storing the current time, metadata being the variable storing the time you want to compare to? ---
### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck) #### Post date: [May 8, 2017, 5:32am UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/6 "2017-05-08T05:32:56Z")
> Hmm what do you mean by configure the age filter accordingly? `[Timestamp][age]` and `[@metadata][age]` are just two different names of fields. The age filter by default writes to `[@metadata][age]`. Your conditional must read from the same field that the age filter writes to. ---
### Author: ![bt3388](https://avatars.discourse-cdn.com/v4/letter/b/a183cd/32.png) [@bt3388](https://discuss.elastic.co/u/bt3388) #### Post date: [May 15, 2017, 6:01pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/7 "2017-05-15T18:01:22Z")
Thank you for help this worked! Now we are running into some issues installing "Age" plugin on a different environment but that is a separate issue. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [June 12, 2017, 6:08pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602/8 "2017-06-12T18:08:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.