# Undefined method \`close' for nil:NilClass
**URL:** https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564
**Category:** Logstash
**Created:** [March 28, 2016, 7:40am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564 "2016-03-28T07:40:03Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@KiraHort](https://discuss.elastic.co/u/KiraHort)
#### Post date: [March 28, 2016, 7:40am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/1 "2016-03-28T07:40:03Z")
Hi everyone. I'm a beginner in Logstash and I have some problem with it. It's, returning "The error reported is: undefined method `close' for nil:NilClass". The full report is:
The error reported is:
undefined method `close' for nil:NilClass /opt/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.2/lib/grok-pure.rb:83:in`add\_patterns\_from\_file'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:361:in `add_patterns_from_files' org/jruby/RubyArray.java:1613:in`each'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:357:in `add_patterns_from_files' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:269:in`register'
org/jruby/RubyArray.java:1613:in `each' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:265:in`register'
org/jruby/RubyHash.java:1342:in `each' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.3/lib/logstash/filters/grok.rb:261:in`register'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:171:in `start_workers' org/jruby/RubyArray.java:1613:in`each'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:171:in `start_workers' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/pipeline.rb:123:in`run'
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/agent.rb:211:in `execute' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:90:in`run'
org/jruby/RubyProc.java:281:in `call' /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.2-java/lib/logstash/runner.rb:95:in`run'
org/jruby/RubyProc.java:281:in `call' /opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:in`initialize'
Config file is too big, to paste it here, but if that's necessary, i'll send it. Thank you
---
### Author:  [@KiraHort](https://discuss.elastic.co/u/KiraHort)
#### Post date: [March 28, 2016, 7:43am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/2 "2016-03-28T07:43:59Z")
That's my config file for logstash
* * *
# Cisco ASA
filter {
if "syslog" in [tags] and "pre-processed" not in [tags] {
if "%ASA-" in [message] {
mutate {
add\_tag =\> ["pre-processed", "Firewall", "ASA"]
}
grok {
match =\> [
"message", "\<%{POSINT:syslog\_pri}\>%{CISCOTIMESTAMP:timestamp} %{SYSLOGHOST:sysloghost} %%{CISCOTAG:cisco\_tag}: %{GREEDYDATA:cisco\_message}"
]
}
syslog\_pri { }
grok {
match =\> [
"cisco\_message", "%{CISCOFW106001}",
"cisco\_message", "%{CISCOFW106006\_106007\_106010}",
"cisco\_message", "%{CISCOFW106014}",
"cisco\_message", "%{CISCOFW106015}",
"cisco\_message", "%{CISCOFW106021}",
"cisco\_message", "%{CISCOFW106023}",
"cisco\_message", "%{CISCOFW106100}",
"cisco\_message", "%{CISCOFW110002}",
"cisco\_message", "%{CISCOFW302010}",
"cisco\_message", "%{CISCOFW302013\_302014\_302015\_302016}",
"cisco\_message", "%{CISCOFW302020\_302021}",
"cisco\_message", "%{CISCOFW305011}",
"cisco\_message", "%{CISCOFW313001\_313004\_313008}",
"cisco\_message", "%{CISCOFW313005}",
"cisco\_message", "%{CISCOFW402117}",
"cisco\_message", "%{CISCOFW402119}",
"cisco\_message", "%{CISCOFW419001}",
"cisco\_message", "%{CISCOFW419002}",
"cisco\_message", "%{CISCOFW500004}",
"cisco\_message", "%{CISCOFW602303\_602304}",
"cisco\_message", "%{CISCOFW710001\_710002\_710003\_710005\_710006}",
"cisco\_message", "%{CISCOFW713172}",
"cisco\_message", "%{CISCOFW733100}",
"cisco\_message", "%{WORD:action} %{WORD:protocol} %{CISCO\_REASON:reason} from %{DATA:src\_interface}:%{IP:src\_ip}/%{INT:src\_port} to %{DATA:dst\_interface}:%{IP:dst\_ip}/%{INT:dst\_port}; %{GREEDYDATA:dnssec\_validation}",
"cisco\_message", "%{CISCO\_ACTION:action} %{WORD:protocol} %{CISCO\_REASON:reason}._(%{IP:src\_ip})._%{IP:dst\_ip} on interface %{GREEDYDATA:interface}",
"cisco\_message", "Connection limit exceeded %{INT:inuse\_connections}/%{INT:connection\_limit} for input packet from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port} on interface %{GREEDYDATA:interface}",
"cisco\_message", "TCP Intercept %{DATA:threat\_detection} to %{IP:ext\_nat\_ip}/%{INT:ext\_nat\_port}.\*(%{IP:int\_nat\_ip}/%{INT:int\_nat\_port}).\*Average rate of %{INT:syn\_avg\_rate} SYNs/sec exceeded the threshold of %{INT:syn\_threshold}.#%{INT}",
"cisco\_message", "Embryonic connection limit exceeded %{INT:econns}/%{INT:limit} for %{WORD:direction} packet from %{IP:src\_ip}/%{INT:src\_port} to %{IP:dst\_ip}/%{INT:dst\_port} on interface %{GREEDYDATA:interface}"
]
}
geoip {
source =\> "src\_ip"
target =\> "geoip"
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert =\> ["[geoip][coordinates]", "float" ]
}
date {
match =\> ["timestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss", "MMM d HH:mm:ss"]
timezone =\> "America/New\_York"
}
mutate {
replace =\> ["host", "%{sysloghost}"]
}
}
}
}
output {
# Example just to output to elasticsearch
elasticsearch { hosts =\> localhost }
stdout { }
}
---
### Author:  [@KiraHort](https://discuss.elastic.co/u/KiraHort)
#### Post date: [March 28, 2016, 10:57am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/3 "2016-03-28T10:57:58Z")
Problem solved. There were files with errors in patterns directory. After removing everything works
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 28, 2016, 11:15am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/4 "2016-03-28T11:15:22Z")
I'm curious—what kind of errors were there? Syntax errors? Permission problems?
---
### Author:  [@KiraHort](https://discuss.elastic.co/u/KiraHort)
#### Post date: [March 28, 2016, 1:50pm UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/5 "2016-03-28T13:50:24Z")
Syntax errors. In fact these files were not necessary at all, so I removed them. Now there are only nginx and grok patterns in that directory and everything works. Not perfect, but works
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/undefined-method-close-for-nil-nilclass/45564/6 "2017-07-06T05:05:11Z")