Ruby exception occurred: undefined method '[]' for nil:NilClass when filtering csv

Elastic Stack Logstash
1

I can't figure out why this filter is throwing this error:

Ruby exception occurred: undefined method [] for nil:NilClass

I have added a check anytime ruby could have thrown an exception:

filter {
        ruby { code => 'event.set("[@metadata][fields]", 1 + event.get("message").count(","))' }
            if [tags] !~ "_rubyexception" {
                if [@metadata][fields] == 29 {
                csv {
                    separator => ","
                    columns => [ "ACTION","DISCRIMINATOR","CHECKPOINT_ID","INSTALLATION_ID","NUMERIC_VALUE","STRING_VALUE","COMPONENT_NAME","TRANSACTION_ID","STATISTIC_DURATION","STATISTIC_NAME","ASSOCIATED_NAME","SINGLE_LATENCY",
                                    "AVERAGE_LATENCY","MAX_LATENCY","MIN_LATENCY","TPS","MAX_LATENCY_TRANSACTION_ID","CREATED_ON_DATE","TOTAL_TRANSACTIONS","PROCESS_NAME","SLA1","SLA2","EXCEPTION_COUNT","CATEGORY","P95","P99","P999",
                                    "P9999","P99999" ]
                    }
                }

                if [@metadata][fields] == 24 {
                    csv {
                        separator => ","
                        columns => [ "ACTION","DISCRIMINATOR","CHECKPOINT_ID","INSTALLATION_ID","NUMERIC_VALUE","STRING_VALUE","COMPONENT_NAME","TRANSACTION_ID","STATISTIC_DURATION","STATISTIC_NAME","ASSOCIATED_NAME","SINGLE_LATENCY",
                                        "AVERAGE_LATENCY","MAX_LATENCY","MIN_LATENCY","TPS","MAX_LATENCY_TRANSACTION_ID","CREATED_ON_DATE","TOTAL_TRANSACTIONS","PROCESS_NAME","SLA1","SLA2","EXCEPTION_COUNT","CATEGORY" ]
                    }
                }

                if [tags] !~ "_csvparsefailure" {
                        ruby { code => "event.set('FW_DATE',Time.at(event.get('CREATED_ON_DATE')[0..9].to_i).strftime('%Y.%m.%d'))" }
                        if [tags] !~ "_rubyexception" {
                            mutate {
                                remove_field => ["ACTION","DISCRIMINATOR","CHECKPOINT_ID","STRING_VALUE","P95","P99","P999","P9999","P99999"]
                                gsub => [
                                    "ASSOCIATED_NAME", "\"", "",
                                    "COMPONENT_NAME", "\"", "",
                                    "STATISTIC_NAME", "\"", "",
                                    "INSTALLATION_ID", "\"", "",
                                    "PROCESS_NAME", "[\",]", "",
                                    "PROCESS_NAME", "^[0-9]*", ""
                                ]
                                convert => {
                                    "CREATED_ON_DATE" => "integer"
                                    "NUMERIC_VALUE" => "integer"
                                    "STATISTIC_DURATION" => "integer"
                                    "SINGLE_LATENCY" => "integer"
                                    "AVERAGE_LATENCY" => "integer"
                                    "MAX_LATENCY" => "integer"
                                    "MIN_LATENCY" => "integer"
                                    "TPS" => "integer"
                                    "TOTAL_TRANSACTIONS" => "integer"
                                    "SLA1" => "integer"
                                    "SLA2" => "integer"
                                    "EXCEPTION_COUNT" => "integer"
                                }
                                replace => {
                                    "INSTALLATION_ID" => "%{[host][name]}"
                                }
                            }
                            date {
                                match => ["CREATED_ON_DATE", "UNIX_MS"]
                                target => "@timestamp"
                            }
                        }
                }
            }
}
2

The normal way to test this is

if "_rubyexception" not in [tags]

The only way I can see you getting "[undefined method ‘[]’ for nil:NilClass" from that configuration is if the event does not have a CREATED_ON_DATE field.

3

Thank you that worked perfectly!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.