The configures is wrong?

Elastic Stack Logstash
1

my logstash-2.2.2 configure
filter {
if [hostname] == "192.168.1.107" and "ERROR" in [message] {
mutate {
add_tag => ["error_107"]
}

  metrics {
    meter => ["error_107"]
    add_tag => ["metric_err107"]
    clear_interval => 60
    flush_interval => 5
    ignore_older_than => 10
   }

  ruby {
    code => "event.cancel if event[error_107][rate_1m]*60 < 5"
    }
}

}

--configtest is ok.but logfile has error,messages:
{:timestamp=>"2016-03-23T19:17:11.914000+0800", :message=>"Ruby exception occurred: undefined local variable or method `error_107' for #LogStash::Filters::Ruby:0x3400b2f0", :level=>:error}

2 
code => "event.cancel if event[error_107][rate_1m]*60 < 5"

Make this:

code => "event.cancel if event['error_107']['rate_1m']*60 < 5"
3

'' is must? Is it related to the logstash version? read the documnet,find some syntax changes.

4

This has nothing to do with the Logstash version. Unless error_107 is an identifier (like e.g. a variable) in the Ruby script but a string literal it needs to be quoted.

5

changed the config,the logs appear this message:
{:timestamp=>"2016-03-24T13:20:30.933000+0800", :message=>"Ruby exception occurred: undefined method `[]' for nil:NilClass", :level=>:error}
@magnusbaeck

6

That indicates that the error_107 field didn't exist. If that indeed is the case you need to wrap your filter in a conditional that checks if that field exists, or add such a conditional to the Ruby sniippet.

7

the error_107 is tag, the filter metrics meter => ["error_107"] . That indicates that the error_107 field didn't exist. so i want to add this field in filter?