# Logstash goes down with ruby in filter

**URL:** <https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073>\
**Category:** Logstash\
**Created:** [June 2, 2017, 11:09am UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073 "2017-06-02T11:09:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)\
**Post date:** [June 2, 2017, 11:09am UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/1 "2017-06-02T11:09:46Z")

</div>

Hello,

I have a filter which were worked when I was in logstash version 2.  
Now Logstash is in version 5 and something goes wrong with a ruby part (I know there is a new behaviour since the v5).  
If I activate the part after "# process time" Logstash stop collecting logs and nothing appears in Kibana.

mutate {  
convert =\> { "processtime" =\> "float" }  
}

# process time

```
                           if [uptime1] == "min" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') * 60 + event.get('ptime2')))"
                                    }
                            }
                            else if [uptime1] == "sec" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') + event.get('ptime2') * 0,001 ))"
                                    }
                            }
                            else if [uptime1] == "ms" {
                                    ruby {
                                            code => "event.set('processtime', ( event.get('ptime1') * 0,001 ))"
                                    }
                            }
                           else {
                                    ruby {
                                            code => "event.set('processtime', 0)"
                                    }
                            }

```

Sometimes Logstash is going "juin 02 12:31:44 frgbmelkidxl2 systemd[1]: Unit logstash.service entered failed state." after restarted it.

I really don't know what to do.

Thanks for your help.  
Antoine

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2017, 11:25am UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/2 "2017-06-02T11:25:12Z")

</div>

Logstash's own log should contain details about what's wrong.

---

<div class="post-metadata">

**Author:** ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)\
**Post date:** [June 2, 2017, 1:35pm UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/3 "2017-06-02T13:35:41Z")

</div>

You mean in /var/log/logstash/logstah-plain.log ?  
I did not see anything wrong in this file.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 2, 2017, 1:42pm UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/4 "2017-06-02T13:42:44Z")

</div>

I'd be very surprised if there was nothing there.

Anyway, the problem might be that you're using a decimal comma instead of a decimal point in your code (i.e. you should use 0.001 instead of 0,001).

---

<div class="post-metadata">

**Author:** ![abrejuin](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abrejuin](https://discuss.elastic.co/u/abrejuin)\
**Post date:** [June 2, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/5 "2017-06-02T14:05:07Z")

</div>

Coooooool, it is working !!  
Thanks a lot I was trying to solve this problem for 2 days !!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2017, 2:05pm UTC](https://discuss.elastic.co/t/logstash-goes-down-with-ruby-in-filter/88073/6 "2017-06-30T14:05:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.