Ruby exception occurred: undefined method `unpack1' for nil:NilClass

Elastic Stack Logstash
1

Hi,
I am trying with below logstash (7.0 version) conf file to decode base64 logs to send elasticsearch but its throwing below error -
[2019-07-17T19:01:36,791][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `unpack1' for nil:NilClass

Logstash.conf file

input {
s3 {
access_key_id => "xxxxxxx"
bucket => "kinesis-datadog"
region => "us-east-1"
secret_access_key => "xxxxxxx8"
prefix => "2019/07/05"
type => "S3"
}
}

filter {
grok {
match => {"message" => "%{WORD:prefix} %{WORD:b64} %{WORD:suffix}"}
}
ruby {
init => "require 'base64'"
code => "event['b64_decoded'] = Base64.decode64(event['b64']) if event.include?('b64')"

}
}

#output plugin, which has the ElasticSearch domain information

output {

elasticsearch {
hosts => ["http://localhost:9200"]
index => ".kibana-%{+YYYY.MM.dd}"
codec => rubydebug
#user => "elastic"
#password => "elastic"
}
}

2

If you are running logstash v7 I would not expect that to work (although I would expect a different error). You should be using the event API.

Try

code => "
    b64 = event.get('b64')
    if b64
        event.set('b64_decoded', Base64.decode64(b64))
    end
"
3

Thanks a lot its worked !!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.