Ruby exception occurred: uninitialized constant when i am trying to devide a field value by 100

Faiz_Shamri · August 13, 2022, 7:47pm

I am trying to devide filed value by 100 but i am getting Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]} [ERROR] 2022-08-14 00:10:07.738 [[main]>worker2] ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'"

here is my conf file:

 filter {
 mutate {
     convert => { "ReloadedAmount" => "integer" }
     }
       ruby{
             code => "event.set('ReloadedAmount', event.get('ReloadedAmount') / event.get('100'))"
    }
}

leandrojmp · August 13, 2022, 9:30pm

Do you have a field named 100 ? Using event.get('100') will make the ruby filter try to get the value of the field named 100.

You should try:

code => "event.set('ReloadedAmount', event.get('ReloadedAmount') / 100)"

You may also need to convert it to a numeric type like float before.

code => "event.set('ReloadedAmount', event.get('ReloadedAmount').to_f / 100)"

Faiz_Shamri · August 14, 2022, 5:38am

Hello @leandrojmp ,
I did the changes you have suguested but still i am getting the same error:

ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'",

I am pasting below my entire conf file:

echo "
Time       User             AccBal           accBalBef     accBalAft     amountReloaded
========================================================================================  
19:10:29   someUser          someClient 24205700      331510000      307304300
" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter  {

	if [message] =~ /^=.*$/ {
     	  drop { }
   	} else if [message] =~ /^Time.*$/ {
     	  drop { }
     	}
   	if [message] == "" {
     		drop { }
   	}
        grok {
            match => { "message" => [ "%{TIME:time}\s*%{USERNAME:User}\s*%{USER:ActorId}\s*%{NUMBER:AccountBef}\s*%{NUMBER:AccountAft}\s*%{NUMBER:ReloadedAmount}" ] }           
        }
       
        grok {
           match => {"[log][file][path]" => "/%{GREEDYDATA}/balanceReload_%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}\.txt$"}
           add_field => ["Ndate", "%{year}-%{month}-%{day} %{time}" ]
        }
       date {
            match => ["Ndate", "yyyy-MM-dd HH:mm:ss"]
            target => "@timestamp"
            timezone => "UTC"
            remove_field => [ "year", "month", "day" ]
      }
     mutate {
     add_field => { "[@metadata][field]" =>  "ReloadedAmount" } 
     convert => { "AccountBef" => "integer" }
     convert => { "AccountAft" => "integer" }
     convert => { "ReloadedAmount" => "integer" }
     }
      ruby {
       code => "event.set('ReloadedAmount', event.get('ReloadedAmount').to_f / 100)"

      } 
       
}
output {

  stdout {}
  
}'

below is the output i get:

[ERROR] 2022-08-14 10:02:07.766 [[main]>worker3] ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'", "(ruby filter code):2:in `block in filter_method'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:96:in `inline_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:89:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:300:in `block in start_workers'"]}
{
             "event" => {
        "original" => "19:10:29  someUser          SomeClient 24205700      331510000      307304300"
    },
        "@timestamp" => 2022-08-14T05:32:07.579729Z,
              "time" => "19:10:29",
        "AccountAft" => 331510000,
           "ActorId" => "someClient",
    "ReloadedAmount" => 307304300,
        "AccountBef" => 24205700,
              "User" => "someUser",
          "@version" => "1",
           "message" => "19:10:29   someName          someClient  24205700      331510000      307304300",
              "host" => {
        "hostname" => "spider"
    },
              "tags" => [
        [0] "_grokparsefailure",
        [1] "_rubyexception"
    ]
}
[INFO ] 2022-08-14 10:02:08.009 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}

Rios · August 14, 2022, 6:16am

Do not coneversion and ruby in the same mutate. Split in two mutate blocks.

Grok is also not ok.

Faiz_Shamri · August 14, 2022, 6:23am

Hello @Rios,
Ruby is outside of mutate block.. Can you plz elaborate more?

Rios · August 14, 2022, 6:52am

Ah sorry,my mistake, I'm reading on mobile.
Ignore my previous comment

leandrojmp · August 14, 2022, 4:42pm

I had the same issue when I tried to run the same you are running it, passing the entire configuration in the cli, no idea what is the cause, probably some internal mixup with single quotes and double quotes.

But if you use the same configuration in a file, it will work without any issue.

I've tested with this configuration, just change the destination field to ReloadedAmount_divided_by_100 to have the two fields and compare.

input { 
    stdin {} 
} 
filter  {
    if [message] =~ /^=.*$/ {
        drop { }
    } else if [message] =~ /^Time.*$/ {
        drop { }
    }
    if [message] == "" {
        drop { }
    }
    grok {
        match => { "message" => [ "%{TIME:time}\s*%{USERNAME:User}\s*%{USER:ActorId}\s*%{NUMBER:AccountBef}\s*%{NUMBER:AccountAft}\s*%{NUMBER:ReloadedAmount}" ] }           
    }
    grok {
        match => {"[log][file][path]" => "/%{GREEDYDATA}/balanceReload_%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}\.txt$"}
        add_field => ["Ndate", "%{year}-%{month}-%{day} %{time}" ]
    }
    date {
        match => ["Ndate", "yyyy-MM-dd HH:mm:ss"]
        target => "@timestamp"
        timezone => "UTC"
        remove_field => [ "year", "month", "day" ]
    }
    mutate {
        add_field => { "[@metadata][field]" =>  "ReloadedAmount" } 
        convert => { "AccountBef" => "integer" }
        convert => { "AccountAft" => "integer" }
        convert => { "ReloadedAmount" => "integer" }
    }
    ruby {
        code => "event.set('ReloadedAmount_divided_by_100', event.get('ReloadedAmount').to_f / 100)"
    }
}
output {
  stdout {} 
}

And running it as:

echo "
Time       User             AccBal           accBalBef     accBalAft     amountReloaded
========================================================================================  
19:10:29   someUser          someClient 24205700      331510000      307304300
" | /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/pipelines/discuss.conf

This is the result:

{
                             "time" => "19:10:29",
                          "ActorId" => "someClient",
                             "host" => "elk",
                             "User" => "someUser",
                       "AccountBef" => 24205700,
                          "message" => "19:10:29   someUser          someClient 24205700      331510000      307304300",
                             "tags" => [
        [0] "_grokparsefailure"
    ],
                       "AccountAft" => 331510000,
    "ReloadedAmount_divided_by_100" => 3073043.0,
                   "ReloadedAmount" => 307304300,
                         "@version" => "1",
                       "@timestamp" => 2022-08-14T16:40:48.136Z
}

Badger · August 14, 2022, 6:19pm

In the bash shell, single quotes cannot occur in single quoted strings.

has three single quoted strings joined by ReloadedAmount, so it reduces to

/usr/share/logstash/bin/logstash -e '....
      ruby {
       code => "event.set(ReloadedAmount, event.get(ReloadedAmount).to_f / 100)"
      } '

In Ruby, any "variable" that starts with an uppercase letter is a constant, so the error is telling you that there is no ReloadedAmount constant. If you use double quotes around the config string you can escape the double quotes within them, so

echo "" | /usr/share/logstash/bin/logstash --path.data $TMPDIR --path.settings /etc/logstash --log.level debug -e "
input { stdin {} }
filter  { ruby { code => 'event.set(\"ReloadedAmount\", 1)' } }
output { stdout {} }"

works.

This quoting behaviour is specific to bash. ksh, csh, and true Bourne shell would do it differently.

system · September 11, 2022, 6:19pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Logstash ruby filter something is wrong Logstash	3	1973	December 27, 2017
Logstash Crashes on Ruby filter when I change a field name Logstash	5	846	March 1, 2019
Help with Ruby code in Logstash Logstash	6	1395	September 4, 2018
[ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `[]' for #<LogStash::Event:0x9a18b32> Logstash	3	893	May 6, 2021
Uninitialized constant logstash::Filters::Ruby::JSON Did you mean? LogStash::Filters::Json Logstash	1	493	September 16, 2019

Ruby exception occurred: uninitialized constant when i am trying to devide a field value by 100

Related topics