Ruby exceptions logstash

Elastic Stack Logstash
1

Hi all,
i'm in trouble with Ruby exceptions i get 2 types of exceptions:

[ERROR][logstash.filters.ruby    ][windows-patching][7da18e5397d31e1f8d249dc2ef273bcbcc32d26e064f064c3138ef1bcbc3c2a0] Ruby exception occurred:
 undefined method `scan' for nil:NilClass
[ERROR][logstash.filters.ruby    ][windows-patching][e0a2523135310fc00c1030f2da81c2f3b28e517f8b2c21c12101e9d813e448ce] Ruby exception occurred: undefined method `[]' for nil:NilClass

I've this kind of ruby filter

filter{
	ruby {
  code => "
	if event.get('Patches available').nil?
		event.remove('[Patches available]')
	end
  "
	}
}

filter{
	ruby {
  code => "
	if event.get('Patches installed').nil?
		event.remove('[Patches installed]')
	end
  "
	}
}

#Questo modulo standardizza il campo Installable Errata e Applicable Errata togliendo "" [ ] \ lo splitta e produce un array di stringhe
filter {
	mutate {
    gsub => [
	"Patches available", "[\[\]]", "",
	"Patches available", "\"", ""
	]
	}
	ruby { code => 'event.set("Patches available", event.get("Patches available").scan(/\(\w+\)/))' }
 }

filter {
	mutate {
    gsub => [
	"Patches installed", "[\[\]]", "",
	"Patches installed", "\"", ""
	]
	}
	ruby { code => 'event.set("Patches installed", event.get("Patches installed").scan(/\(\w+\)/))' }
}

filter{
	ruby {
  code => "
	if event.get('Patches available').nil?
		event.set('N_Patches_available', 0)
		event.remove('[Patches available]')
	else
		event.set('N_Patches_available', (event.get('Patches available').length))
	end
  "
	}
}

filter{
	ruby {
  code => "
	if event.get('Patches installed').nil?
		event.set('N_Patches_installed', 0)
		event.remove('[Patches installed]')
	else
		event.set('N_Patches_installed', (event.get('Patches installed').length))
	end
  "
	}
}

Maybe the problem is due to the fact that in some case one of the field is empty so "scan" cannnot scan any data?

I would like to totaly remove the field if it is nil and\or to avoid exceptions. Do you know of to do that? Someting like a " if not event.nil? " ?! I'm not a Ruby expert.

KR

Roberto

2

Your first two ruby filters potentially delete the field [Patches available], but after running the mutate you unconditionally call ruby code which runs .scan on its value. That is going to result in that "undefined method `scan' for nil:NilClass" exception.

You could try wrapping the mutate and 3rd ruby filter in

if [Patches available] {
    ...
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.