Ruby exception error on logstash

Hi, im formating a date string with the following code.

                ruby {
                        code => '
                            time = event.get("fecha")
                            fe = Date.strptime(time, "%m/%d/%Y")
                            event.set("fecha", fe.strftime("%d/%m/%Y"))

the code works, but at the beggining of the rubydebug output, gives me multiple lines with this error:

Ruby exception occurred: class org.jruby.RubyNil cannot be cast to class org.jruby.RubyString (org.jruby.RubyNil and org.jruby.RubyString are in unnamed module of loader 'app')

how can I get rid of this?


Is it possible that the field fecha might be unset in some events? In this case you should be able to check for the field before converting the date.

Best regards

1 Like

Hi there,

as Wolfram said, some of the processed documents might don't have the fecha field assigned. It is a good practice to check for the existence of a given field before working with it. Try something like this:

ruby {
  code => '
    unless (time = event.get("fecha")).nil?
      event.set("fecha", Date.strptime(time, "%m/%d/%Y").strftime("%d/%m/%Y"))
1 Like

Thanks both, it works, but I was wandering if a document doesn't have the fecha field assigned, why I dont get a grok parse failure?

Why should you get a _grokparsefailure without applying a grok filter? :wink:

You're applying a Ruby filter, not a grok. And when you try to get the fecha field on a document which doesn't have it, you're assigning the value nil to the variable time. Then, you're trying to apply a string method to that nil value, so it raises an exception.

Grok has nothing to do with this.

Hi fabio, the fecha field comes from a grok filter, Im manipulating it with ruby after de grok.

Can you post here the sample message that doesn't return a fecha field and the grok filter you're applying before the ruby (or also your whole pipeline)?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.