Logstash goes down with ruby in filter

[abrejuin (Antoine)]

Hello,

I have a filter which were worked when I was in logstash version 2.
Now Logstash is in version 5 and something goes wrong with a ruby part (I know there is a new behaviour since the v5).
If I activate the part after "# process time" Logstash stop collecting logs and nothing appears in Kibana.

mutate {
convert => { "processtime" => "float" }
}

process time

                           if [uptime1] == "min" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') * 60 + event.get('ptime2')))"
                                    }
                            }
                            else if [uptime1] == "sec" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') + event.get('ptime2') * 0,001 ))"
                                    }
                            }
                            else if [uptime1] == "ms" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') * 0,001 ))"
                                    }
                            }
                           else {
                                    ruby {
                                            code => "event.set('processtime', 0)"
                                    }
                            }

Sometimes Logstash is going "juin 02 12:31:44 frgbmelkidxl2 systemd[1]: Unit logstash.service entered failed state." after restarted it.

I really don't know what to do.

Thanks for your help.
Antoine

[magnusbaeck (Magnus Bäck)]

Logstash's own log should contain details about what's wrong.

[abrejuin (Antoine)]

You mean in /var/log/logstash/logstah-plain.log ?
I did not see anything wrong in this file.

Thanks

[magnusbaeck (Magnus Bäck)]

I'd be very surprised if there was nothing there.

Anyway, the problem might be that you're using a decimal comma instead of a decimal point in your code (i.e. you should use 0.001 instead of 0,001).

[abrejuin (Antoine)]

Coooooool, it is working !!
Thanks a lot I was trying to solve this problem for 2 days !!