Mutate+copy of @timestamp gets NullPointerException

Elastic Stack Logstash
1

In 6.2.4, when I try to do a mutate+copy of @timestamp it blows up with a NullPointerException. Is there another way to do this?

input { generator { message => '2018/05/11 12:34:56' count => 1 } }
filter {
    date { match => [ "message", "yyyy/MM/dd HH:mm:ss" ] }
    mutate { copy => { "@timestamp" => "foo" } }
}
output { stdout { codec => rubydebug } }

The top of the stack trace looks like this:

Exception in thread "Ruby-0-Thread-14@[main]>worker0: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385" java.lang.NullPointerException
        at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp.ruby_to_iso8601(JrubyTimestampExtLibrary.java:112)
        at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp.ruby_inspect(JrubyTimestampExtLibrary.java:106)
        at org.logstash.ext.JrubyTimestampExtLibrary$RubyTimestamp$INVOKER$i$0$0$ruby_inspect.call(JrubyTimestampExtLibrary$RubyTimestamp$INVOKER$i$0$0$ruby_inspect.gen)
        at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:318)

Replacing the rubydebug output with an elasticsearch output gets you "An unknown error occurred sending a bulk request to Elasticsearch" instead.

2

It looks like this was a bug.
https://github.com/elastic/logstash/issues/8888 and fix: https://github.com/elastic/logstash/pull/9405

I reproduced this on 6.2.4 and verified it is indeed fixed in 6.3.0 (released today)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.