Uninitialized constant LogStash::Filters::CIDR::IPAddr

Elastic Stack Logstash
1

Hi All,

For some reason I am getting the below error. I have checked my CIDR config and the appear correct to me. I do several CIDR checks like below where I set different tags and use different networks.

Can someone point me in the right direction to solve this issue?

Thanks.

if [source_ip] =~ /\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/ {
  cidr {
    add_tag => [ "localnet" ]
    address => [ "%{source_ip}" ]
    network => [ "127.0.0.1/16", "172.25.10.0/23", "172.25.160.0/23", "172.25.165.0/23" ]
  }
  if 'localnet' not in [tags] {
    geoip {
      database => "/opt/GeoLite2/GeoLite2-City.mmdb"
      source => "source_ip"
    }
  }
}

[2019-11-25T16:26:37,216][ERROR][logstash.agent ] An exception happened when converging configuration {:exception=>NameError, :message=>"uninitialized constant LogStash::Filters::CIDR::IPAddr", :backtrace=>["org/jruby/RubyModule.java:3742:in const_missing'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:126:in block in filter'", "org/jruby/RubyArray.java:2572:in collect'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:124:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:in block in multi_filter'", "org/jruby/RubyArray.java:1792:in each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in multi_filter'", "(eval):1564289:in block in initialize'", "org/jruby/RubyArray.java:1792:in each'", "(eval):1564286:in block in initialize'", "(eval):1564307:in block in initialize'", "org/jruby/RubyArray.java:1792:in each'", "(eval):1564301:in block in initialize'", "(eval):1564321:in block in initialize'", "org/jruby/RubyArray.java:1792:in each'", "(eval):1564318:in block in initialize'", "(eval):67511:in block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in block in start_workers'"]}

2

Ruby classes are constants, and this is telling you that the IPAddr class is uninitialized. Yet it is referenced in a require by cidr.rb. I have no idea how that could happen. Unless somehow you have an ipaddr that satisfies the require but does not define IPAddr.

127.0.0.1 is normally a /8, not a /16.

3

Hmm, so it could happen when there is a extra character on the start or the end of the IP address I feed it? That could explain it I guess however I only see this error when I start logstash.

I'll dig a bit deeper, thanks so far.

Paul.

4

No, what I meant was that I would expect this line of code to end up including this code, but it does not seem to be doing that.

5

Ahh now it makes sense :slight_smile: as I am on ls 6.8.0 I might upgrade to 6.8.5 and see if that clears it up.

Thanks.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.