Logstash error : no implicit conversion of nil into Integer

Hello, elastic people, I have been making a filter in logstash of a conditional to analyze the status of a team according to the metrics, I tried it, but I get the following error, I need help with this please:

[ERROR] 2021-06-22 13:51:18.834 [[main]>worker0] javapipeline - Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"main                              ", :error=>"(TypeError) no implicit conversion of nil into Integer", :exception=>Java::OrgJrubyExceptions::TypeError, :backtrace=>["usr.                              share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline                              .rb:295)"], :thread=>"#<Thread:0x27df57a3 sleep>"}

this is my config in the file logstash:

input {
  snmp {
    hosts => [{host => "udp:10.10.66.12/161" version => "3"}]
    get => ["1.3.6.1.4.1.3375.2.1.1.2.1.45.0", "1.3.6.1.2.1.1.5.0", "1.3.6.1.4.1.3375.2.1.1.2.1.44.0", "1.3.6.1.4.1.2021.9.1.7.1", "1.3.6.1.2.1.1.6.0", "1.3.6.1.4.1.2021.4.5.0"]
    get => ["1.3.6.1.4.1.3375.2.1.1.2.12.6.0", "1.3.6.1.4.1.3375.2.1.1.2.1.3.0", "1.3.6.1.4.1.3375.2.1.1.2.1.5.0"]
    walk => ["1.3.6.1.4.1.3375.2.1.7.5.2.1.27", "1.3.6.1.4.1.2021.9.1.9", "1.3.6.1.4.1.3375.2.1.3.2.3.2.1.2", "1.3.6.1.4.1.3375.2.1.1.2.12.9"]
    security_name => "efectivo"
    auth_protocol => "sha"
    auth_pass => "3f3ct1v0"
    priv_protocol => "aes"
    priv_pass => "3f3ct1v0"
    security_level => "authPriv"
    interval => 60
  }
}

filter {
 if [host] == "10.10.66.12" {
 mutate {
 add_field => {"state" => 0}
       convert => {
                        "MemoryTotal" => "integer"
                        "MemoryUsage" => "integer"
                        "state" => "integer"
                        }
  convert => { "CPUTotal" => "integer" }
  convert => { "MemoriaUsadaTotal" => "integer" }
   rename => ["host","IP"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.5.0", "Out"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.3.0", "In"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.12.6.0", "NewConnects"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysName.0", "Sysname"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.45.0", "MemoryUsage"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.44.0", "MemoryFree"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.4.5.0", "MemoryTotal"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.1", "CPU1"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.2", "CPU2"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.3", "CPU3"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.4", "CPU4"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.1", "Disk1Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.2", "Disk2Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.7.1", "DiskFree"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysLocation.0", "SysLocation"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.3.2.3.2.1.2.1", "ChasisTemp"]
  }
 ruby {
    code => "event.set('CPUTotal', (event.get('CPU1') + event.get('CPU2') + event.get('CPU3') + event.get('CPU4')) / 4)"
  }
 ruby {
    code => "event.set('MemoriaUsadaTotal', event.get('MemoryUsage') / event.get('MemoryTotal'))"
  }
 }
  if [CPUTotal] > "40" {
   mutate {
    update => {"state" => "1"}
 }
}
  else if [ChasisTemp] > "45" {
   mutate { update => {"state" => "2" }
 }
}
  else if [MemoriaUsadaTotal] > "40" {
  mutate { update => {"state" => "3" }
 }
}
  else {
   mutate { update => {"state" => "0" }
  }
 }
}

output {
 stdout {}
# elasticsearch {
 #   hosts => ["xxxxxxxxxxxxxxxxxxxxxxxxxxx"]
  #  user => "elastic"
  #  password => "xxxxxxxxxxxxxxx"
   # index => "efecty"
   #}
 }

A mutate filter does things in a fixed order, and add_field happens at the end, so when it tries to convert "state" => "integer" the state field does not exist. You will need to split this into two mutate filters.

rename happens before convert, which is what you want.

I tried what you told me but I still get the error, I don't know why?

filter {
 if [host] == "10.10.66.12" {
mutate { add_field => {"state" => 0}
    convert => {"state" => "integer"}
}
 mutate {
       convert => {
                        "MemoryTotal" => "integer"
                        "MemoryUsage" => "integer"
                        }
  convert => { "CPUTotal" => "integer" }
  convert => { "MemoriaUsadaTotal" => "integer" }
   rename => ["host","IP"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.5.0", "Out"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.3.0", "In"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.12.6.0", "NewConnects"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysName.0", "Sysname"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.45.0", "MemoryUsage"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.44.0", "MemoryFree"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.4.5.0", "MemoryTotal"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.1", "CPU1"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.2", "CPU2"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.3", "CPU3"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.4", "CPU4"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.1", "Disk1Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.2", "Disk2Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.7.1", "DiskFree"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysLocation.0", "SysLocation"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.3.2.3.2.1.2.1", "ChasisTemp"]
  }
 ruby {
    code => "event.set('CPUTotal', (event.get('CPU1') + event.get('CPU2') + event.get('CPU3') + event.get('CPU4')) / 4)"
  }
 ruby {
    code => "event.set('MemoriaUsadaTotal', event.get('MemoryUsage') / event.get('MemoryTotal'))"
  }
 }
  if [CPUTotal] > "40" {
   mutate {
    update => {"state" => "1"}
 }
}
  else if [ChasisTemp] > "45" {
   mutate { update => {"state" => "2" }
 }
}
  else if [MemoriaUsadaTotal] > "40" {
  mutate { update => {"state" => "3" }
 }
}
  else {
   mutate { update => {"state" => "0" }
  }
 }
}

The add_field and the convert need to be in separate mutate filters. add_field first, then mutate.

I saw what it was, it's because of the (" ") that's why I got the error, I removed the (" ") from the numbers and it worked.

filter {
 if [host] == "10.10.66.12" {
mutate { add_field => {"state" => 0}
}
 mutate {
       convert => {     "MemoryTotal" => "integer"
                        "MemoryUsage" => "integer"
                        }
  convert => { "CPUTotal" => "integer" }
  convert => { "MemoriaUsadaTotal" => "integer" }
   rename => ["host","IP"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.5.0", "Out"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.3.0", "In"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.12.6.0", "NewConnects"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysName.0", "Sysname"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.45.0", "MemoryUsage"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.1.2.1.44.0", "MemoryFree"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.4.5.0", "MemoryTotal"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.1", "CPU1"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.2", "CPU2"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.3", "CPU3"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.7.5.2.1.27.1.48.4", "CPU4"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.1", "Disk1Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.9.2", "Disk2Usage"]
   rename => ["iso.org.dod.internet.private.enterprises.2021.9.1.7.1", "DiskFree"]
   rename => ["iso.org.dod.internet.mgmt.mib-2.system.sysLocation.0", "SysLocation"]
   rename => ["iso.org.dod.internet.private.enterprises.3375.2.1.3.2.3.2.1.2.1", "ChasisTemp"]
  }
 ruby {
    code => "event.set('CPUTotal', (event.get('CPU1') + event.get('CPU2') + event.get('CPU3') + event.get('CPU4')) / 4)"
  }
 ruby {
    code => "event.set('MemoriaUsadaTotal', event.get('MemoryUsage') / event.get('MemoryTotal'))"
  }
    if [CPUTotal] > 5 {
   mutate {
    update => {"state" => 1}
 }
  if [ChasisTemp] > 10 {
   mutate { update => {"state" => 2 }
 }
 if [MemoriaUsadaTotal] > 13 {
  mutate { update => {"state" => 3 }
 }
}
}}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.