Logstash Uknown error while parsing user agent data

Using logstash 7.1, in logs I repeated see the below mentioned error messages. What can I do to get more information on the reason of these errors? Also, if it is known problem, can you guide on what could be the issue here?

I tried adding below lines in log4j2.properties and restarting logstash, but no new logs were generated.

log4j2.properties
logger.useragent.name = logstash.filters.useragent
logger.useragent.level = debug

Error Messages
[2019-06-11T13:54:10,836][ERROR][logstash.filters.useragent] Uknown error while parsing user agent data {:exception=>#<TypeError: cannot convert instance of class org.jruby.RubyHash to class java.lang.String>, :field=>"agent", :event=>#LogStash::Event:0x251fc06e}
[2019-06-11T13:54:10,836][ERROR][logstash.filters.useragent] Uknown error while parsing user agent data {:exception=>#<TypeError: cannot convert instance of class org.jruby.RubyHash to class java.lang.String>, :field=>"agent", :event=>#LogStash::Event:0x54d0c346}
[2019-06-11T13:54:10,836][ERROR][logstash.filters.useragent] Uknown error while parsing user agent data {:exception=>#<TypeError: cannot convert instance of class org.jruby.RubyHash to class java.lang.String>, :field=>"agent", :event=>#LogStash::Event:0x397a8814}
[2019-06-11T13:54:10,837][ERROR][logstash.filters.useragent] Uknown error while parsing user agent data {:exception=>#<TypeError: cannot convert instance of class org.jruby.RubyHash to class java.lang.String>, :field=>"agent", :event=>#LogStash::Event:0x5a69d23}

The issue was in the logstash filter for access logs, I was parsing the log content related to user agent and saving it in a field named "agent" and was using useragent plugin on this agent field. In 7.x version "agent" seems to be an internal field used by beats. So, I changed the name to "user_agent" and used that in useragent plugin. Changing the name resolved the error.

4 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.