Ruby LS filter error and slow logstash



I'm just wondering why whenever I try to use a ruby filter in my logstash conf file I get a very slow response from logstash when I try to restart it, plus the filter wont wont work and tailing LS logs with debug level I get the following.

[2017-05-31T15:53:19,510][DEBUG][logstash.agent ] Error in reactor loop escaped: Bad file descriptor - Bad file descriptor (Errno::EBADF)
[2017-05-31T15:53:19,513][DEBUG][logstash.agent ] 2017-05-31 15:53:19 -0400: Listen loop error: #<Errno::EBADF: Bad file descriptor - Bad file descriptor>
[2017-05-31T15:53:19,513][DEBUG][logstash.agent ] ["org/jruby/ select'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/reactor.rb:29:inrun_internal'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/reactor.rb:138:in `run_in_thread'"]

I am using LS 5.4 and trying to do this:

filter {

   json {
      source => "message"

   ruby {
            code => "event.set('my_result_field,  event.get('[received_statistics][vcpus_used]')"


looked in the file throwing the error and the issue at the following lines:
-> ready = sockets, nil, nil, @sleep_for
-> run_internal

not really a Ruby user and I would appreoatce any help as all im trying to do with filter is simple math.

original intention:
ruby {

           code=> "event['vcpu_used_test'] = event%{[statistics][available_cpu]}.to_i - event%{[statistics][cpu_used]}.to_i"


So far nothing has worked for me and logstash keeps throwing this error or will keep restarting itself for some reason. I have worked with a fair amount of LS filters and configs but never with ruby. I have also seen some old similar cases but I believe it should be fixed at this point, if understood the old threads right. So not sure if related to my system or the LS itself.

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.