Logstash output mongodb plugin error

Elastic Stack Logstash
1

when I use logstash to collect data from syslog to mongodb and filter is dissect or grok, logstash log show error and can't transfer data, below is error message:

[2018-03-12T02:16:59,739][WARN ][logstash.outputs.mongodb ] Failed to send event to MongoDB {:event=>#LogStash::Event:0x20e5e1a0, :exception=>#<NoMethodError: undefined method to_json' for nil:NilClass Did you mean? to_bson>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-mongodb-3.1.3/lib/logstash/outputs/mongodb.rb:81:inreceive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in block in multi_receive'", "org/jruby/RubyArray.java:1734:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator_strategies/legacy.rb:22:inmulti_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:479:inblock in output_batch'", "org/jruby/RubyHash.java:1343:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:478:inoutput_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:430:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385:inblock in start_workers'"]}

I am very confused and because I could successfully put data to mongodb before. Besides, I tested and stdout correct result with commenting output mongodb plugin. Who can help me and encountered similar problem? Thanks.

2

It looks like the logstash-output-mongodb plugin expects each event to have a timestamp, and fails in this hard-to-decipher way whenever it encounters an event that doesn't have a timestamp.

You may want to use logstash-filter-date to extract a timestamp from one of your other fields:

filter {
  date {
    match => ["date-field", "ISO8601"]
  }
}
3

Thanks very much. It is helpful.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.