# Ruby exception error on logstash

**URL:** https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944
**Category:** Logstash
**Created:** [March 3, 2020, 8:37pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944 "2020-03-03T20:37:36Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [March 3, 2020, 8:37pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/1 "2020-03-03T20:37:37Z")

</div>

Hi, im formating a date string with the following code.

```auto
                ruby {
                        code => '
                            time = event.get("fecha")
                            event.remove("fecha")
                            fe = Date.strptime(time, "%m/%d/%Y")
                            event.set("fecha", fe.strftime("%d/%m/%Y"))
                        '
                }

```

the code works, but at the beggining of the rubydebug output, gives me multiple lines with this error:

```auto
Ruby exception occurred: class org.jruby.RubyNil cannot be cast to class org.jruby.RubyString (org.jruby.RubyNil and org.jruby.RubyString are in unnamed module of loader 'app')

```

how can I get rid of this?

---

<div class="post-metadata">

### Author: ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [March 4, 2020, 6:48am UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/2 "2020-03-04T06:48:15Z")

</div>

Hi,

Is it possible that the field **fecha** might be unset in some events? In this case you should be able to check for the field before converting the date.

Best regards  
Wolfram

---

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 4, 2020, 8:01am UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/3 "2020-03-04T08:01:22Z")

</div>

Hi there,

as Wolfram said, some of the processed documents might don't have the `fecha` field assigned. It is a good practice to check for the existence of a given field before working with it. Try something like this:

```
ruby {
  code => '
    unless (time = event.get("fecha")).nil?
      event.set("fecha", Date.strptime(time, "%m/%d/%Y").strftime("%d/%m/%Y"))
    end
  '
}
```

---

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [March 4, 2020, 1:41pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/4 "2020-03-04T13:41:44Z")

</div>

Thanks both, it works, but I was wandering if a document doesn't have the fecha field assigned, why I dont get a grok parse failure?

---

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 4, 2020, 2:08pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/5 "2020-03-04T14:08:13Z")

</div>

Why should you get a `_grokparsefailure` without applying a `grok` filter? 😉

You're applying a Ruby filter, not a grok. And when you try to get the `fecha` field on a document which doesn't have it, you're assigning the value `nil` to the variable `time`. Then, you're trying to apply a string method to that `nil` value, so it raises an exception.

Grok has nothing to do with this.

---

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [March 4, 2020, 2:27pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/6 "2020-03-04T14:27:45Z")

</div>

Hi fabio, the fecha field comes from a grok filter, Im manipulating it with ruby after de grok.

---

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [March 4, 2020, 2:29pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/7 "2020-03-04T14:29:24Z")

</div>

Can you post here the sample message that doesn't return a fecha field and the grok filter you're applying before the ruby (or also your whole pipeline)?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2020, 2:29pm UTC](https://discuss.elastic.co/t/ruby-exception-error-on-logstash/221944/8 "2020-04-01T14:29:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
