Logstash crashes with "comparison of String with 0 failed"

Elastic Stack Logstash
1

OK, previous problem solved. New problem found.

I have the following in my conf file:

        if [VirtualHost] =~ /^\d+\.\d+\.\d+\.\d+$/ {
                mutate {
                        add_tag => ["NakedIP"]
                }
        }

        if [VirtualHost] and "NakedIP" not in [tags] {
                if [VirtualHost] != "-" {
                        tld {
                                source => "VirtualHost"
                        }
                }
        }

        if [tld][domain] { mutate {rename => { "[tld][domain]" => "highest_registered_domain" }}}

If I leave the last line uncommented, I get the following errors and LS crashes repeatedly. If I delete or comment that line out, everything runs smooth.

[ERROR][logstash.pipeline        ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"comparison of String with 0 failed", "backtrace"=>["org/jruby/RubyComparable.java:186:in `>'", "org/jruby/RubyString.java:1736:in `>'", "(eval):10315:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):10313:in `block in initialize'", "(eval):10332:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):10327:in `block in initialize'", "(eval):1687:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start_workers'"], :thread=>"#<Thread:0x2972688d@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:173 sleep>"}
[2019-04-11T20:38:34,522][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<ArgumentError: comparison of String with 0 failed>, :backtrace=>["org/jruby/RubyComparable.java:186:in `>'", "org/jruby/RubyString.java:1736:in `>'", "(eval):10315:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):10313:in `block in initialize'", "(eval):10332:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):10327:in `block in initialize'", "(eval):1687:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start_workers'"]}
[2019-04-11T20:38:34,540][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

tld seems to be working just fine. Here is a sample of what it shows when things run:

               "tld" => {
          "sld" => "digicert",
          "trd" => "crl3",
          "tld" => "com",
       "domain" => "digicert.com",
    "subdomain" => "crl3.digicert.com"
 },

But if I try and do anything with the fields and/or subfields, LS crashes with the above error.

Running LS 6.7, logstash-filter-mutate (3.4.0), logstash-filter-tld (3.0.3), CentOS 6.x

Suggestions?

2

OK, I've been working on this for a while with tech support and my own testing. Here is the current situation:
Upgraded to LS 7.0
That changed the error above to 'no implicit conversion of nil into Integer'
But either way, I've narrowed the error down to below:

For THIS function:

         if [site_rank] and [site_rank]!="" and [site_rank] &gt; 0 {

                  mutate {

                          add_tag =&gt; ["top1M"]

                  }

          }

if the site_rank field has NOT been populated for some reason, I get the 'no implicit conversion of nil into Integer' error. And the conditional statements above do not seem to prevent the error.

Also tried

     if [site_rank] and [site_rank]!="" {

           if [site_rank] &gt; 0 {

              mutate {

                      add_tag =&gt; ["top1M"]

              }

           }

      }

So, how do I check to see if site_rank is nil?
Is this the solution: Logstash convert Nil values into a number

3

That works for me if the site_rank field does not exist. To get the exception site_rank has to exist and be a string. Interestingly, although the first test short-circuits the rest, the second test does not. If site_rank is set to "" then it get the exception.

The error message changed because pipeline.java_execution is on by default in version 7. If you disable it in logstash.yml you will start getting "comparison of String with 0 failed" again.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.