# Logstash Ruby filter error

**URL:** https://discuss.elastic.co/t/logstash-ruby-filter-error/245216
**Category:** Logstash
**Created:** [August 17, 2020, 10:17am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216 "2020-08-17T10:17:03Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [August 17, 2020, 1:29pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216/4 "2020-08-17T13:29:48Z")

</div>

> [@Apollyon](#):
>
> `if [dst_ip] === %{IPV6} {`

And Logstash didn't crash with this configuration? I don't know where you got that, but that kind of syntax and functionality doesn't exist. You could follow this example: [How to check client\_ip ipv4 or ipv6? - #3 by Badger](https://discuss.elastic.co/t/how-to-check-client-ip-ipv4-or-ipv6/240654/3) (Additionally you should maybe check that the field isn't an empty string.)

And it's `tag_on_exception`, not `tag_on_expection`. But that only changes the tag, it doesnt suppress the error message.

(And just one more comment: You can shorten your IP with just one line of code: [in ruby how to remove the last part of ip address - Stack Overflow](https://stackoverflow.com/questions/35039333/in-ruby-how-to-remove-the-last-part-of-ip-address))

---

_[View the full topic](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216)._