' for nil:NilClass>, :backtrace=>["(eval):8760880:in `block in initialize'", "org/jruby/RubyArray.java:1734:in `each'", "(eval):8760878:in `block in initialize'", "(eval):8760903:in `block in initialize'", "org/jruby/RubyArray.java:1734:in `each'", "(eval):8760895:in `block in initialize'", "(eval):237947:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:341:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:320:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:286:in `block in start_workers'"]}
[2019-10-21T10:58:21,095][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2019-10-21T10:58:37,143][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.5.4"}
```
Ruby code in logstash filter is as below.
```auto
ruby {
code => 'event.set("alertmeval",event.get("CurrentVal").to_i - (event.get("MaxValAllowed").to_i*0.7))'
}
mutate {
convert => {
"CurrentVal" => "integer"
"MaxValAllowed" => "integer"
}
}
```
`MaxValAllowed` can be from 5000 to 200000.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 21, 2019, 5:39pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/2 "2019-10-21T17:39:42Z")
> [@paano](#):
>
> Ruby exception occurred: undefined method `to\_i' for [284, 0]:Array
OK, so either [CurrentVal] or [MaxValAllowed] is an array containing the values [284, 0]. You would have to select an item from the array to call .to\_i on it.
If you are complaining that such a minor error causes logstash to have to restart, which is very expensive, I would agree with you. I believe there are open issues around exception handling in the java execution engine. The ruby engine was much better at catching these and just restarting the pipeline.
---
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [October 21, 2019, 9:52pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/3 "2019-10-21T21:52:48Z")
Interestingly, the data is not an array. Will need to identify the record which is causing it.
By adding `[0]` should be ok as below?
```auto
ruby {
code => 'event.set("alertmeval",event.get("CurrentVal")[0].to_i - (event.get("MaxValAllowed")[0].to_i*0.7))'
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 21, 2019, 10:26pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/4 "2019-10-21T22:26:20Z")
That will break when it is not an array. You could try something like
```
CurrentVal = event.get("CurrentVal")
if CurrentVal.is_a? Array
CurrentVal = CurrentVal[0]
end
```
I haven't tested that though.
---
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [October 22, 2019, 7:37pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/5 "2019-10-22T19:37:17Z")
@Badger I looked at the data, and did not have any Array result. Inserted the data without the ruby code, to view in elastic.
Used SQL Query to get field values but would not find.
Is there any other way to debug? Or in logstash another option to write a math formula.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 22, 2019, 8:15pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/6 "2019-10-22T20:15:34Z")
There is a [math](https://github.com/logstash-plugins/logstash-filter-math) filter. You might need to install it.
---
### Author:  [@paano](https://discuss.elastic.co/u/paano)
#### Post date: [October 29, 2019, 6:41pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/7 "2019-10-29T18:41:13Z")
@Badger i was able to correct the ruby code. Thanks for the pointer `nil`.
If a field is not defined, and used in condition ruby filter throws error.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 26, 2019, 6:41pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526/8 "2019-11-26T18:41:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.