Logstash-output-influxdb 5.0.5 NullPointerException

Elastic Stack Logstash
1

Hi,

I run logstash 6.5.4 on docker. It work normally before I install the plugin：logstash-output-influxdb 5.0.5

my logstash's output_config:
if "firewall_traffic" in [input_type] {
if "noop" in [trandisp] or "snat" in [trandisp] or "dnat" in [trandisp] {
influxdb {
db => "traffic"
host => "influxdb"
port => "9086"
coerce_values => {
"sentbyte" => "integer"
"rcvdbyte" => "integer"
"sentpkt" => "integer"
"rcvdpkt" => "integer"
"srcport" => "integer"
"dstport" => "integer"
"proto" => "integer"
}
measurement => "%{trandisp}"
send_as_tags => ["devid", "service", "status", "subtype","localip"]
data_points => {
"app" => "%{app}"
"srcip" => "%{srcip}"
"srcport" => "%{srcport}"
"dstip" => "%{dstip}"
"dstport" => "%{dstport}"
"sentbyte" => "%{sentbyte}"
"rcvdbyte" => "%{rcvdbyte}"
"sentpkt" => "%{sentpkt}"
"rcvdpkt" => "%{rcvdpkt}"
"proto" => "%{proto}"
"devid" => "%{devid}"
"service" => "%{service}"
"status" => "%{status}"
"subtype" => "%{subtype}"
"localip" => "%{localip}"
}
}
}
}

when I gen this json data to logstash:
{
"app" => "HTTP",
"subtype" => "forward",
"input_type" => "firewall_traffic",
"sentbyte" => "43085",
"rcvdbyte" => "29883",
"sentpkt" => "162",
"status" => "accept",
"host" => "10.1.101.69",
"devid" => "123456",
"localip" => "192.168.32.96",
"dstip" => "110.231.234.204",
"dstport" => "43050",
"service" => "HTTP",
"uuid" => "85a3029a-37bb-4694-be53-acadd0f0b2eb",
"rcvdpkt" => "37",
"srcport" => "63443",
"type" => "traffic",
"proto" => "6",
"devuuid" => "0f1655db-fffe-4b48-8595-c7366361eb0e",
"start" => "2019-01-17T10:30:42.329Z",
"srcip" => "192.168.32.96",
"tndevid" => "firewall_10.1.101.69",
"trandisp" => "snat",
"rt" => "2019-01-17T10:30:42.329Z"
}

2

the docker logs:
[2019-01-18T07:26:58,266][INFO ][org.apache.kafka.clients.Metadata] Cluster ID: eZez94JzTxm3uaJFWArvYA
Exception in thread "Ruby-0-Thread-35: :1" java.lang.NullPointerException
at org.jruby.ir.targets.InvokeSite.pollAndGetClass(InvokeSite.java:444)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:125)
at usr.share.logstash.vendor.bundle.jruby.$2_dot_3_dot_0.gems.logstash_minus_output_minus_influxdb_minus_5_dot_0_dot_5.lib.logstash.outputs.influxdb.RUBY$method$timestamp_at_precision$0(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-influxdb-5.0.5/lib/logstash/outputs/influxdb.rb:303)
at usr.share.logstash.vendor.bundle.jruby.$2_dot_3_dot_0.gems.logstash_minus_output_minus_influxdb_minus_5_dot_0_dot_5.lib.logstash.outputs.influxdb.RUBY$method$timestamp_at_precision$0$VARARGS(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-influxdb-5.0.5/lib/logstash/outputs/influxdb.rb)
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)
at usr.share.logstash.vendor.bundle.jruby.$2_dot_3_dot_0.gems.logstash_minus_output_minus_influxdb_minus_5_dot_0_dot_5.lib.logstash.outputs.influxdb.RUBY$method$receive$0(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-influxdb-5.0.5/lib/logstash/outputs/influxdb.rb:155)
at usr.share.logstash.vendor.bundle.jruby.$2_dot_3_dot_0.gems.logstash_minus_output_minus_influxdb_minus_5_dot_0_dot_5.lib.logstash.outputs.influxdb.RUBY$method$receive$0$VARARGS(/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-influxdb-5.0.5/lib/logstash/outputs/influxdb.rb)
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)
at usr.share.logstash.logstash_minus_core.lib.logstash.outputs.base.RUBY$block$multi_receive$1(/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:89)
at org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:156)
at org.jruby.runtime.BlockBody.yield(BlockBody.java:114)
at org.jruby.runtime.Block.yield(Block.java:165)
at org.jruby.RubyArray.each(RubyArray.java:1734)
at org.jruby.RubyArray$INVOKER$i$0$0$each.call(RubyArray$INVOKER$i$0$0$each.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodZeroBlock.call(JavaMethod.java:498)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)
at usr.share.logstash.logstash_minus_core.lib.logstash.outputs.base.RUBY$method$multi_receive$0(/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:89)
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:103)
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:163)
at org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:200)
at org.logstash.config.ir.compiler.OutputStrategyExt$AbstractOutputStrategyExt.invokeOutput(OutputStrategyExt.java:124)
at org.logstash.config.ir.compiler.OutputStrategyExt$LegacyOutputStrategyExt.output(OutputStrategyExt.java:188)
at org.logstash.config.ir.compiler.OutputStrategyExt$AbstractOutputStrategyExt.multiReceive(OutputStrategyExt.java:114)
at org.logstash.config.ir.compiler.OutputDelegatorExt.doOutput(OutputDelegatorExt.java:78)
at org.logstash.config.ir.compiler.AbstractOutputDelegatorExt.multiReceive(AbstractOutputDelegatorExt.java:97)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$block$output_batch$3(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:373)
at org.jruby.runtime.CompiledIRBlockBody.yieldDirect(CompiledIRBlockBody.java:156)
at org.jruby.runtime.BlockBody.yield(BlockBody.java:114)
at org.jruby.runtime.Block.yield(Block.java:165)
at org.jruby.RubyHash$12.visit(RubyHash.java:1362)
at org.jruby.RubyHash$12.visit(RubyHash.java:1359)
at org.jruby.RubyHash.visitLimited(RubyHash.java:662)
at org.jruby.RubyHash.visitAll(RubyHash.java:647)
at org.jruby.RubyHash.iteratorVisitAll(RubyHash.java:1319)
at org.jruby.RubyHash.each_pairCommon(RubyHash.java:1354)
at org.jruby.RubyHash.each(RubyHash.java:1343)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$method$output_batch$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:372)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$method$output_batch$0$VARARGS(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb)
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$method$worker_loop$0(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:324)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$method$worker_loop$0$VARARGS(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb)
at org.jruby.internal.runtime.methods.CompiledIRMethod.call(CompiledIRMethod.java:77)
at org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:93)
at org.jruby.ir.targets.InvokeSite.invoke(InvokeSite.java:145)
at usr.share.logstash.logstash_minus_core.lib.logstash.pipeline.RUBY$block$start_workers$2(/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:286)
at org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:145)
at org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:71)
at org.jruby.runtime.Block.call(Block.java:124)
at org.jruby.RubyProc.call(RubyProc.java:289)
at org.jruby.RubyProc.call(RubyProc.java:246)
at org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:104)
at java.lang.Thread.run(Thread.java:748)

when it happens, I can't see any logs in influxdb sever after I enable the influxdb's debug config.

3

Thanks! :grinning:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.