Logstash error: Could not process event: no implicit conversion of NilClass into String

Elastic Stack Logstash
1

Iam getting the error
Could not process event: no implicit conversion of NilClass into String in logstash ruby filter. Here is the ruby file which iam using in the logstash filter:

def filter(event)
    require 'json'
    require 'time'
    event_data_full = event.get('message')
    parsed = JSON.parse(event_data_full)
    created_key = parsed["created"]
    created = parsed["created"]
    job = parsed["job"]
    playbook = parsed["playbook"]
    event_keyword = parsed["event"]
    failed = parsed["failed"]
    uuid = parsed["uuid"]

    created = 'NO DATA' if created.nil?
    job = 'NO DATA' if job.nil?
    playbook = 'NO DATA' if playbook.nil?
    event_keyword = 'NO DATA' if event_keyword.nil?
    failed = 'NO DATA' if failed.nil?
    uuid = 'NO DATA' if uuid.nil?


    unreachable_if_exists = parsed["event_data"]["dark"]
    failures_if_exists = parsed["event_data"]["failures"]
    processed_if_exists = parsed["event_data"]["processed"]

    created_field_seconds = Time.parse(created_key).to_f * 1000

    unreachable = 0 if unreachable_if_exists.nil?
    failures = 0 if failures_if_exists.nil?
    processed = 0 if processed_if_exists.nil?
    if unreachable != 0
        unreachable = unreachable_if_exists.count
    end
    if failures !=0
            failures = failures_if_exists.count
    end
    if processed != 0
            processed = processed_if_exists.count
    end

    event.set('unreachable',unreachable.to_i)
    event.set('failures',failures.to_i)
    event.set('processed',processed.to_i)
    event.set('created_field_seconds',created_field_seconds.to_i)
    event.set('created',created.to_s)
    event.set('job',job.to_s)
    event.set('playbook',playbook.to_s)
    event.set('event_keyword',event_keyword.to_s)
    event.set('failed',failed.to_s)
    event.set('uuid',uuid.to_s)

    return [event]

end

Any help would be appreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.