# Ruby Code - Converting Socket Address Error

**URL:** <https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425>\
**Category:** Logstash\
**Created:** [November 20, 2017, 4:22pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425 "2017-11-20T16:22:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kazul33](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kazul33](https://discuss.elastic.co/u/kazul33)\
**Post date:** [November 20, 2017, 4:22pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425/1 "2017-11-20T16:22:42Z")

</div>

I'm working with Auditd data. I have the SADDR within a log message and I'm trying to convert it using some ruby code.

Here is my snippet:

```auto
filter {
    ruby {
        code => "
            require 'socket'
            temp = event.get('[event_data][saddr]')
            unless temp == nil?
                hex = [temp].pack('H*')
                decoded = Socket.unpack_sockaddr_in(hex)
                event.set('[event_data][port]', decoded[0])
                event.set('[event_data][ip]', decoded[1])
            end
        "
    }
}

```

However, this throws an exception: "Ruby exception occurred: not an AF\_INET/AF\_INET6 sockaddr"

I know that should be working, because I can take a static one liner within irb that I confirmed works, but yet in logstash it will fail with the same exception:

```auto
filter {
      ruby {
        code => "
                #require 'socket'
                output = Socket.unpack_sockaddr_in(['020000357F0001010000000000000000'].pack('H*'))
        "
      }
    }
}

```

Any ideas on why this ruby code isn't working?

---

<div class="post-metadata">

**Author:** ![kazul33](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kazul33](https://discuss.elastic.co/u/kazul33)\
**Post date:** [November 20, 2017, 4:56pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425/2 "2017-11-20T16:56:01Z")

</div>

Hmm, I think this may have to do something with weird encoding.

I am extracting the SADDR and sticking the raw bytes into a field within elasticsearch:

```auto
ruby {
code => "
        require 'socket'
        temp = event.get('[event_data][saddr]')
        unless temp == nil?
                hex = [temp].pack('H*')
                event.set('[event_data][debug]', hex)
        end     
"
}

```

Raw Bytes of the Debug:

```auto
"debug": "\u0002\u0000\u00005\u0000\u0001\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000

```

I believe when I'm extracting the string from event.get and then converting it via the pack, the data is being modified to some unicode that is not accurate.

---

<div class="post-metadata">

**Author:** ![kazul33](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kazul33](https://discuss.elastic.co/u/kazul33)\
**Post date:** [November 20, 2017, 7:09pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425/3 "2017-11-20T19:09:22Z")

</div>

Another update.

I don't seem to be able to use event.set without it trying to do unicode data.

For that matter, I believe my pack('H\*') is resulting in unicode, which I think is the crux of the problem. However, I am unable to figure out why it continues to transpose the data into unicode.

Working straight from ruby results in the expected results, but something within logstash filter of ruby is executing something that isn't representative or straight ruby.

Any ideas?

---

<div class="post-metadata">

**Author:** ![kazul33](https://avatars.discourse-cdn.com/v4/letter/k/87869e/32.png) [@kazul33](https://discuss.elastic.co/u/kazul33)\
**Post date:** [November 21, 2017, 8:55pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425/4 "2017-11-21T20:55:45Z")

</div>

So the answer to this riddle is JRuby.

The function call `Socket.unpack_sockaddr_in` with JRuby does not unpack the same way regular ruby does.  
We downloaded the JRuby which apparently differs than the JRuby built with Logstash 6.0.0.

E.g., if you have an saddr of: `02000050D02B66FA0000000000000000`

This unpacks in normal ruby as:

`\x02\x00\x00\x50\xD0\x2B\x66\xFA\x00\x00\x00\x00\x00\x00\x00\x00`

In the specific version of JRuby (NOT regular JRuby which you can download, but the compiled version of Logstash 6.0.0), if you do the same function, you will get a different answer:

`\x00\x02\x00\x50\xD0\x2B\x66\xFA\x00\x00\x00\x00\x00\x00\x00\x00`

You'll notice that the first two bytes are flipped.

You can confirm this by entering into the interactive ruby session with the logstash:

```auto
./logstash --interactive=irb
irb(main):041:0> a = Socket.sockaddr_in(80, "208.43.102.250")
=> "\x00\x02\x00P\xD0+f\xFA\x00\x00\x00\x00\x00\x00\x00\x00"

```

So in order to compensate for this calculation, you'll have to flip the first two bytes (`0200` to `0002`) in order to get the correct answer.

I'd be very interested in why this is the reason from one of the devs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2017, 8:55pm UTC](https://discuss.elastic.co/t/ruby-code-converting-socket-address-error/108425/5 "2017-12-19T20:55:47Z")

</div>

Closed on December 19, 2017, 8:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.