Undefined method `close' for nil:NilClass

Hi everyone. I'm a beginner in Logstash and I have some problem with it. It's, returning "The error reported is: undefined method `close' for nil:NilClass". The full report is:

The error reported is:
undefined method close' for nil:NilClass /opt/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.2/lib/grok-pure.rb:83:inadd_patterns_from_file'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:361:in add_patterns_from_files' org/jruby/RubyArray.java:1613:ineach'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:357:in add_patterns_from_files' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:269:inregister'
org/jruby/RubyArray.java:1613:in each' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:265:inregister'
org/jruby/RubyHash.java:1342:in each' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:261:inregister'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:171:in start_workers' org/jruby/RubyArray.java:1613:ineach'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:171:in start_workers' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:123:inrun'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/agent.rb:211:in execute' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:90:inrun'
org/jruby/RubyProc.java:281:in call' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:95:inrun'
org/jruby/RubyProc.java:281:in call' /opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:ininitialize'

Config file is too big, to paste it here, but if that's necessary, i'll send it. Thank you

That's my config file for logstash


Cisco ASA

filter {
if "syslog" in [tags] and "pre-processed" not in [tags] {
if "%ASA-" in [message] {
mutate {
add_tag => [ "pre-processed", "Firewall", "ASA" ]
}
grok {
match => [
"message", "<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp} %{SYSLOGHOST:sysloghost} %%{CISCOTAG:cisco_tag}: %{GREEDYDATA:cisco_message}"
]
}
syslog_pri { }
grok {
match => [
"cisco_message", "%{CISCOFW106001}",
"cisco_message", "%{CISCOFW106006_106007_106010}",
"cisco_message", "%{CISCOFW106014}",
"cisco_message", "%{CISCOFW106015}",
"cisco_message", "%{CISCOFW106021}",
"cisco_message", "%{CISCOFW106023}",
"cisco_message", "%{CISCOFW106100}",
"cisco_message", "%{CISCOFW110002}",
"cisco_message", "%{CISCOFW302010}",
"cisco_message", "%{CISCOFW302013_302014_302015_302016}",
"cisco_message", "%{CISCOFW302020_302021}",
"cisco_message", "%{CISCOFW305011}",
"cisco_message", "%{CISCOFW313001_313004_313008}",
"cisco_message", "%{CISCOFW313005}",
"cisco_message", "%{CISCOFW402117}",
"cisco_message", "%{CISCOFW402119}",
"cisco_message", "%{CISCOFW419001}",
"cisco_message", "%{CISCOFW419002}",
"cisco_message", "%{CISCOFW500004}",
"cisco_message", "%{CISCOFW602303_602304}",
"cisco_message", "%{CISCOFW710001_710002_710003_710005_710006}",
"cisco_message", "%{CISCOFW713172}",
"cisco_message", "%{CISCOFW733100}",
"cisco_message", "%{WORD:action} %{WORD:protocol} %{CISCO_REASON:reason} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}; %{GREEDYDATA:dnssec_validation}",
"cisco_message", "%{CISCO_ACTION:action} %{WORD:protocol} %{CISCO_REASON:reason}.(%{IP:src_ip}).%{IP:dst_ip} on interface %{GREEDYDATA:interface}",
"cisco_message", "Connection limit exceeded %{INT:inuse_connections}/%{INT:connection_limit} for input packet from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} on interface %{GREEDYDATA:interface}",
"cisco_message", "TCP Intercept %{DATA:threat_detection} to %{IP:ext_nat_ip}/%{INT:ext_nat_port}.*(%{IP:int_nat_ip}/%{INT:int_nat_port}).*Average rate of %{INT:syn_avg_rate} SYNs/sec exceeded the threshold of %{INT:syn_threshold}.#%{INT}",
"cisco_message", "Embryonic connection limit exceeded %{INT:econns}/%{INT:limit} for %{WORD:direction} packet from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} on interface %{GREEDYDATA:interface}"
]
}
geoip {
source => "src_ip"
target => "geoip"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
}
date {
match => [ "timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss", "MMM d HH:mm:ss" ]
timezone => "America/New_York"
}
mutate {
replace => [ "host", "%{sysloghost}" ]
}
}
}
}

output {

Example just to output to elasticsearch

elasticsearch { hosts => localhost }
stdout { }
}

Problem solved. There were files with errors in patterns directory. After removing everything works

I'm curious—what kind of errors were there? Syntax errors? Permission problems?

Syntax errors. In fact these files were not necessary at all, so I removed them. Now there are only nginx and grok patterns in that directory and everything works. Not perfect, but works