Logstash stops randomly with NoMethodError: undefined method `split' for nil:NilClass Exception

Elastic Stack Logstash
1

Hi,

Logstash stops running randomly with below exception message. Would really appreciate any pointers to resolve this issue:

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.", "exception"=>#<NoMethodError: undefined method split' for nil:NilClass>** , "backtrace"=>[**"C:/ELK/logstash-2.2.1/logstash-2.2.1/lib/logstash/filters/eventsplitter.rb:23:infilter'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/filters/base.rb:151:in multi_filter'", "org/jruby/RubyArray.java:1613:ineach'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/filters/base.rb:148:in multi_filter'", "(eval):427:infilter_func'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:256:in filter_batch'", "org/jruby/RubyArray.java:1613:ineach'", "org/jruby/RubyEnumerable.java:852:in inject'", "C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:254:infilter_batch'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:212:in worker_loop'", "C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:190:instart_workers'"], :level=>:error}

Here is the eventsplitter.rb file (see line # 23 below where error is thrown):

image
image.png725×722 11.5 KB

And this is how it is called from Logstash config:

input {
rabbitmq {
durable => true
exchange => "XXXXXXXXXXX"
host => "USXXXXXXXXXXX"
user => "XX"
password => "XXX"
port => 5672
queue => "XXXXXXXXXXX"
vhost => "/"
}
}
filter {
ruby{
init => "
require 'base64'
require 'zlib'
"

			code => "
						#UnZIP the dyanamic data and store it into payload_json event field
						event['payload_json'] = Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate(Base64.decode64(event['message']))
			        "
					
					#Removing unwanted fields
					remove_field=>['message']
					remove_field=>['headers']
					
	}
		

	#Breaking http input message into multiple event
	**eventsplitter**

** {**
** row_split => "\n"**
** field_split => ","**
** value_split => "~"**

** }**

2

event['something'] returns null when the field doesn't exist so that's probably what happened here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.