OUI issues


#1

Successfully installed the OUI plugin but the following error keeps occuring within the logstash log:

[2017-01-19T14:48:07,125][ERROR][logstash.pipeline ] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<NoMethodError: undefined method strip' for nil:NilClass>, "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:into_i'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in find'", "/usr/share/logstash/vendor/jruby/lib/ruby/1.9/monitor.rb:211:inmon_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in find'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.0-java/lib/logstash/filters/oui.rb:33:infilter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:inmulti_filter'", "org/jruby/RubyArray.java:1613:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:inmulti_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in multi_filter'", "(eval):304:infilter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in filter_batch'", "org/jruby/RubyProc.java:281:incall'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in each'", "org/jruby/RubyHash.java:1342:ineach'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:191:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:instart_workers'"]}

This causes the logstash pipeline to close then restart, though some OUI data is making to my elastic search instance. The MACs i'm sending are all fine too.

anybody got any ideas?

Thanks in advance

zen


#2

Just to let you know i solved the problem by regexing the field as a MAC address before using oui and updating the oui.txt not sure if both changes or just one solved the issue. may investigate further in time.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.