Hi,
Logstash stops running randomly with below exception message. Would really appreciate any pointers to resolve this issue:
Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.", "exception"=>#<NoMethodError: undefined method split' for nil:NilClass>** , "backtrace"=>[**"C:/ELK/logstash-2.2.1/logstash-2.2.1/lib/logstash/filters/eventsplitter.rb:23:infilter'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/filters/base.rb:151:in multi_filter'", "org/jruby/RubyArray.java:1613:ineach'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/filters/base.rb:148:in multi_filter'", "(eval):427:infilter_func'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:256:in filter_batch'", "org/jruby/RubyArray.java:1613:ineach'", "org/jruby/RubyEnumerable.java:852:in inject'", "C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:254:infilter_batch'",
"C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:212:in worker_loop'", "C:/ELK/logstash-2.2.1/logstash-2.2.1/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.1-java/lib/logstash/pipeline.rb:190:instart_workers'"], :level=>:error}
Here is the eventsplitter.rb file (see line # 23 below where error is thrown):
And this is how it is called from Logstash config:
input {
rabbitmq {
durable => true
exchange => "XXXXXXXXXXX"
host => "USXXXXXXXXXXX"
user => "XX"
password => "XXX"
port => 5672
queue => "XXXXXXXXXXX"
vhost => "/"
}
}
filter {
ruby{
init => "
require 'base64'
require 'zlib'
"
code => "
#UnZIP the dyanamic data and store it into payload_json event field
event['payload_json'] = Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate(Base64.decode64(event['message']))
"
#Removing unwanted fields
remove_field=>['message']
remove_field=>['headers']
}
#Breaking http input message into multiple event
**eventsplitter**
** {**
** row_split => "\n"**
** field_split => ","**
** value_split => "~"**
** }**