# Uninitialized constant LogStash::Filters::CIDR::IPAddr

**URL:** <https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337>\
**Category:** Logstash\
**Created:** [November 25, 2019, 3:33pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337 "2019-11-25T15:33:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [November 25, 2019, 3:33pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/1 "2019-11-25T15:33:48Z")

</div>

Hi All,

For some reason I am getting the below error. I have checked my CIDR config and the appear correct to me. I do several CIDR checks like below where I set different tags and use different networks.

Can someone point me in the right direction to solve this issue?

Thanks.

> ```
> if [source_ip] =~ /\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/ {
> cidr {
> add_tag => ["localnet"]
> address => ["%{source_ip}"]
> network => ["127.0.0.1/16", "172.25.10.0/23", "172.25.160.0/23", "172.25.165.0/23"]
> }
> if 'localnet' not in [tags] {
> geoip {
> database => "/opt/GeoLite2/GeoLite2-City.mmdb"
> source => "source_ip"
> }
> }
> }
> 
> ```

> [2019-11-25T16:26:37,216][ERROR][logstash.agent] An exception happened when converging configuration {:exception=\>NameError, :message=\>"uninitialized constant LogStash::Filters::CIDR::IPAddr", :backtrace=\>["org/jruby/RubyModule.java:3742:in `const_missing'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:126:in `block in filter'", "org/jruby/RubyArray.java:2572:in `collect'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-cidr-3.1.2-java/lib/logstash/filters/cidr.rb:124:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:in `block in multi\_filter'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `multi\_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in `multi_filter'", "(eval):1564289:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):1564286:in `block in initialize'", "(eval):1564307:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):1564301:in `block in initialize'", "(eval):1564321:in `block in initialize'", "org/jruby/RubyArray.java:1792:in `each'", "(eval):1564318:in `block in initialize'", "(eval):67511:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start\_workers'"]}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 25, 2019, 4:31pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/2 "2019-11-25T16:31:47Z")

</div>

Ruby classes are constants, and this is telling you that the IPAddr class is uninitialized. Yet it is referenced in a require by cidr.rb. I have no idea how that could happen. Unless somehow you have an ipaddr that satisfies the require but does not define IPAddr.

127.0.0.1 is normally a /8, not a /16.

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [November 25, 2019, 6:34pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/3 "2019-11-25T18:34:30Z")

</div>

Hmm, so it could happen when there is a extra character on the start or the end of the IP address I feed it? That could explain it I guess however I only see this error when I start logstash.

I'll dig a bit deeper, thanks so far.

Paul.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 25, 2019, 7:06pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/4 "2019-11-25T19:06:46Z")

</div>

No, what I meant was that I would expect [this](https://github.com/logstash-plugins/logstash-filter-cidr/blob/04f2a6a89faf88dbdc6d2aaba92af61f38bb77c9/lib/logstash/filters/cidr.rb#L4) line of code to end up including [this](https://github.com/ruby/ipaddr/blob/5dec35734e152a255a03034705c7b771f8dc482b/lib/ipaddr.rb#L42) code, but it does not seem to be doing that.

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [November 25, 2019, 7:10pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/5 "2019-11-25T19:10:39Z")

</div>

Ahh now it makes sense 🙂 as I am on ls 6.8.0 I might upgrade to 6.8.5 and see if that clears it up.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2019, 7:23pm UTC](https://discuss.elastic.co/t/uninitialized-constant-logstash-ipaddr/209337/6 "2019-12-23T19:23:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
