Ruby exception occurred: uninitialized constant when i am trying to devide a field value by 100

I am trying to devide filed value by 100 but i am getting Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]} [ERROR] 2022-08-14 00:10:07.738 [[main]>worker2] ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'"

here is my conf file:

 filter {
 mutate {
     convert => { "ReloadedAmount" => "integer" }
     }
       ruby{
             code => "event.set('ReloadedAmount', event.get('ReloadedAmount') / event.get('100'))"
    }
}

Do you have a field named 100 ? Using event.get('100') will make the ruby filter try to get the value of the field named 100.

You should try:

code => "event.set('ReloadedAmount', event.get('ReloadedAmount') / 100)"

You may also need to convert it to a numeric type like float before.

code => "event.set('ReloadedAmount', event.get('ReloadedAmount').to_f / 100)"

Hello @leandrojmp ,
I did the changes you have suguested but still i am getting the same error:

ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'",

I am pasting below my entire conf file:

echo "
Time       User             AccBal           accBalBef     accBalAft     amountReloaded
========================================================================================  
19:10:29   someUser          someClient 24205700      331510000      307304300
" | /usr/share/logstash/bin/logstash -e 'input { stdin {} } filter  {

	if [message] =~ /^=.*$/ {
     	  drop { }
   	} else if [message] =~ /^Time.*$/ {
     	  drop { }
     	}
   	if [message] == "" {
     		drop { }
   	}
        grok {
            match => { "message" => [ "%{TIME:time}\s*%{USERNAME:User}\s*%{USER:ActorId}\s*%{NUMBER:AccountBef}\s*%{NUMBER:AccountAft}\s*%{NUMBER:ReloadedAmount}" ] }           
        }
       
        grok {
           match => {"[log][file][path]" => "/%{GREEDYDATA}/balanceReload_%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}\.txt$"}
           add_field => ["Ndate", "%{year}-%{month}-%{day} %{time}" ]
        }
       date {
            match => ["Ndate", "yyyy-MM-dd HH:mm:ss"]
            target => "@timestamp"
            timezone => "UTC"
            remove_field => [ "year", "month", "day" ]
      }
     mutate {
     add_field => { "[@metadata][field]" =>  "ReloadedAmount" } 
     convert => { "AccountBef" => "integer" }
     convert => { "AccountAft" => "integer" }
     convert => { "ReloadedAmount" => "integer" }
     }
      ruby {
       code => "event.set('ReloadedAmount', event.get('ReloadedAmount').to_f / 100)"

      } 
       
}
output {

  stdout {}
  
}'

below is the output i get:

[ERROR] 2022-08-14 10:02:07.766 [[main]>worker3] ruby - Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::ReloadedAmount {:class=>"NameError", :backtrace=>["org/jruby/RubyModule.java:3766:in `const_missing'", "(ruby filter code):2:in `block in filter_method'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:96:in `inline_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.8/lib/logstash/filters/ruby.rb:89:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1821:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:300:in `block in start_workers'"]}
{
             "event" => {
        "original" => "19:10:29  someUser          SomeClient 24205700      331510000      307304300"
    },
        "@timestamp" => 2022-08-14T05:32:07.579729Z,
              "time" => "19:10:29",
        "AccountAft" => 331510000,
           "ActorId" => "someClient",
    "ReloadedAmount" => 307304300,
        "AccountBef" => 24205700,
              "User" => "someUser",
          "@version" => "1",
           "message" => "19:10:29   someName          someClient  24205700      331510000      307304300",
              "host" => {
        "hostname" => "spider"
    },
              "tags" => [
        [0] "_grokparsefailure",
        [1] "_rubyexception"
    ]
}
[INFO ] 2022-08-14 10:02:08.009 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}

Do not coneversion and ruby in the same mutate. Split in two mutate blocks.

Grok is also not ok.

Hello @Rios,
Ruby is outside of mutate block.. Can you plz elaborate more?

Ah sorry,my mistake, I'm reading on mobile.
Ignore my previous comment

I had the same issue when I tried to run the same you are running it, passing the entire configuration in the cli, no idea what is the cause, probably some internal mixup with single quotes and double quotes.

But if you use the same configuration in a file, it will work without any issue.

I've tested with this configuration, just change the destination field to ReloadedAmount_divided_by_100 to have the two fields and compare.

input { 
    stdin {} 
} 
filter  {
    if [message] =~ /^=.*$/ {
        drop { }
    } else if [message] =~ /^Time.*$/ {
        drop { }
    }
    if [message] == "" {
        drop { }
    }
    grok {
        match => { "message" => [ "%{TIME:time}\s*%{USERNAME:User}\s*%{USER:ActorId}\s*%{NUMBER:AccountBef}\s*%{NUMBER:AccountAft}\s*%{NUMBER:ReloadedAmount}" ] }           
    }
    grok {
        match => {"[log][file][path]" => "/%{GREEDYDATA}/balanceReload_%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}\.txt$"}
        add_field => ["Ndate", "%{year}-%{month}-%{day} %{time}" ]
    }
    date {
        match => ["Ndate", "yyyy-MM-dd HH:mm:ss"]
        target => "@timestamp"
        timezone => "UTC"
        remove_field => [ "year", "month", "day" ]
    }
    mutate {
        add_field => { "[@metadata][field]" =>  "ReloadedAmount" } 
        convert => { "AccountBef" => "integer" }
        convert => { "AccountAft" => "integer" }
        convert => { "ReloadedAmount" => "integer" }
    }
    ruby {
        code => "event.set('ReloadedAmount_divided_by_100', event.get('ReloadedAmount').to_f / 100)"
    }
}
output {
  stdout {} 
}

And running it as:

echo "
Time       User             AccBal           accBalBef     accBalAft     amountReloaded
========================================================================================  
19:10:29   someUser          someClient 24205700      331510000      307304300
" | /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/pipelines/discuss.conf 

This is the result:

{
                             "time" => "19:10:29",
                          "ActorId" => "someClient",
                             "host" => "elk",
                             "User" => "someUser",
                       "AccountBef" => 24205700,
                          "message" => "19:10:29   someUser          someClient 24205700      331510000      307304300",
                             "tags" => [
        [0] "_grokparsefailure"
    ],
                       "AccountAft" => 331510000,
    "ReloadedAmount_divided_by_100" => 3073043.0,
                   "ReloadedAmount" => 307304300,
                         "@version" => "1",
                       "@timestamp" => 2022-08-14T16:40:48.136Z
}

In the bash shell, single quotes cannot occur in single quoted strings.

has three single quoted strings joined by ReloadedAmount, so it reduces to

/usr/share/logstash/bin/logstash -e '....
      ruby {
       code => "event.set(ReloadedAmount, event.get(ReloadedAmount).to_f / 100)"
      } '

In Ruby, any "variable" that starts with an uppercase letter is a constant, so the error is telling you that there is no ReloadedAmount constant. If you use double quotes around the config string you can escape the double quotes within them, so

echo "" | /usr/share/logstash/bin/logstash --path.data $TMPDIR --path.settings /etc/logstash --log.level debug -e "
input { stdin {} }
filter  { ruby { code => 'event.set(\"ReloadedAmount\", 1)' } }
output { stdout {} }"

works.

This quoting behaviour is specific to bash. ksh, csh, and true Bourne shell would do it differently.

2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.