Ruby exception error on logstash

[Incauto]

Hi, im formating a date string with the following code.

                ruby {
                        code => '
                            time = event.get("fecha")
                            event.remove("fecha")
                            fe = Date.strptime(time, "%m/%d/%Y")
                            event.set("fecha", fe.strftime("%d/%m/%Y"))
                        '
                }

the code works, but at the beggining of the rubydebug output, gives me multiple lines with this error:

Ruby exception occurred: class org.jruby.RubyNil cannot be cast to class org.jruby.RubyString (org.jruby.RubyNil and org.jruby.RubyString are in unnamed module of loader 'app')

how can I get rid of this?

[Wolfram_Haussig]

Hi,

Is it possible that the field fecha might be unset in some events? In this case you should be able to check for the field before converting the date.

Best regards
Wolfram

[Fabio-sama (Fabio)]

Hi there,

as Wolfram said, some of the processed documents might don't have the fecha field assigned. It is a good practice to check for the existence of a given field before working with it. Try something like this:

ruby {
  code => '
    unless (time = event.get("fecha")).nil?
      event.set("fecha", Date.strptime(time, "%m/%d/%Y").strftime("%d/%m/%Y"))
    end
  '
}

[Incauto]

Thanks both, it works, but I was wandering if a document doesn't have the fecha field assigned, why I dont get a grok parse failure?

[Fabio-sama (Fabio)]

Why should you get a _grokparsefailure without applying a grok filter?

You're applying a Ruby filter, not a grok. And when you try to get the fecha field on a document which doesn't have it, you're assigning the value nil to the variable time. Then, you're trying to apply a string method to that nil value, so it raises an exception.

Grok has nothing to do with this.

[Incauto]

Hi fabio, the fecha field comes from a grok filter, Im manipulating it with ruby after de grok.

[Fabio-sama (Fabio)]

Can you post here the sample message that doesn't return a fecha field and the grok filter you're applying before the ruby (or also your whole pipeline)?