# OUI issues

**URL:** <https://discuss.elastic.co/t/oui-issues/72182>\
**Category:** Logstash\
**Created:** [January 19, 2017, 3:20pm UTC](https://discuss.elastic.co/t/oui-issues/72182 "2017-01-19T15:20:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zen\_spartan](https://avatars.discourse-cdn.com/v4/letter/z/b2d939/32.png) [@zen\_spartan](https://discuss.elastic.co/u/zen_spartan)\
**Post date:** [January 19, 2017, 3:20pm UTC](https://discuss.elastic.co/t/oui-issues/72182/1 "2017-01-19T15:20:16Z")

</div>

Successfully installed the OUI plugin but the following error keeps occuring within the logstash log:

[2017-01-19T14:48:07,125][ERROR][logstash.pipeline] Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=\>#\<NoMethodError: undefined method `strip' for nil:NilClass>, "backtrace"=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:109:in`to\_i'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:97:in `find'", "/usr/share/logstash/vendor/jruby/lib/ruby/1.9/monitor.rb:211:in`mon\_synchronize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/oui-offline-1.2.7-java/lib/oui.rb:95:in `find'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-oui-3.0.0-java/lib/logstash/filters/oui.rb:33:in`filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in`multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in`multi\_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:41:in `multi_filter'", "(eval):304:in`filter\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in `filter_batch'", "org/jruby/RubyProc.java:281:in`call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:192:in `each'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped\_synchronous\_queue.rb:191:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in`filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in`start\_workers'"]}

This causes the logstash pipeline to close then restart, though some OUI data is making to my elastic search instance. The MACs i'm sending are all fine too.

anybody got any ideas?

Thanks in advance

zen

---

<div class="post-metadata">

**Author:** ![zen\_spartan](https://avatars.discourse-cdn.com/v4/letter/z/b2d939/32.png) [@zen\_spartan](https://discuss.elastic.co/u/zen_spartan)\
**Post date:** [January 20, 2017, 8:08am UTC](https://discuss.elastic.co/t/oui-issues/72182/2 "2017-01-20T08:08:43Z")

</div>

Just to let you know i solved the problem by regexing the field as a MAC address before using oui and updating the oui.txt not sure if both changes or just one solved the issue. may investigate further in time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2017, 8:08am UTC](https://discuss.elastic.co/t/oui-issues/72182/3 "2017-02-17T08:08:47Z")

</div>

Closed on February 17, 2017, 8:08am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.