# The configures is wrong?
**URL:** https://discuss.elastic.co/t/the-configures-is-wrong/45213
**Category:** Logstash
**Created:** [March 23, 2016, 11:19am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213 "2016-03-23T11:19:59Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@thoma](https://discuss.elastic.co/u/thoma)
#### Post date: [March 23, 2016, 11:19am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/1 "2016-03-23T11:19:59Z")
my logstash-2.2.2 configure
filter {
if [hostname] == "192.168.1.107" and "ERROR" in [message] {
mutate {
add\_tag =\> ["error\_107"]
}
```
metrics {
meter => ["error_107"]
add_tag => ["metric_err107"]
clear_interval => 60
flush_interval => 5
ignore_older_than => 10
}
ruby {
code => "event.cancel if event[error_107][rate_1m]*60 < 5"
}
}
```
}
--configtest is ok.but logfile has error,messages:
{:timestamp=\>"2016-03-23T19:17:11.914000+0800", :message=\>"Ruby exception occurred: undefined local variable or method `error\_107' for #LogStash::Filters::Ruby:0x3400b2f0", :level=\>:error}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2016, 11:41am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/2 "2016-03-23T11:41:52Z")
> ```
> code => "event.cancel if event[error_107][rate_1m]*60 < 5"
>
> ```
Make this:
```
code => "event.cancel if event['error_107']['rate_1m']*60 < 5"
```
---
### Author:  [@thoma](https://discuss.elastic.co/u/thoma)
#### Post date: [March 23, 2016, 2:16pm UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/3 "2016-03-23T14:16:20Z")
'' is must? Is it related to the logstash version? read the documnet,find some syntax changes.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 23, 2016, 2:30pm UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/4 "2016-03-23T14:30:36Z")
This has nothing to do with the Logstash version. Unless `error_107` is an identifier (like e.g. a variable) in the Ruby script but a string literal it needs to be quoted.
---
### Author:  [@thoma](https://discuss.elastic.co/u/thoma)
#### Post date: [March 24, 2016, 5:20am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/5 "2016-03-24T05:20:53Z")
changed the config,the logs appear this message:
{:timestamp=\>"2016-03-24T13:20:30.933000+0800", :message=\>"Ruby exception occurred: undefined method `[]' for nil:NilClass", :level=\>:error}
@magnusbaeck
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 24, 2016, 5:35am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/6 "2016-03-24T05:35:33Z")
That indicates that the `error_107` field didn't exist. If that indeed is the case you need to wrap your filter in a conditional that checks if that field exists, or add such a conditional to the Ruby sniippet.
---
### Author:  [@thoma](https://discuss.elastic.co/u/thoma)
#### Post date: [March 24, 2016, 6:28am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/7 "2016-03-24T06:28:03Z")
the error\_107 is tag, the filter metrics meter =\> ["error\_107"] . That indicates that the error\_107 field didn't exist. so i want to add this field in filter?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/the-configures-is-wrong/45213/8 "2017-07-06T05:05:36Z")