Yes. "keep_line" isn't a Ruby variable, it's a field in the current event. I'm not sure what Logstash is complaining about. Judging by the error message there's something about the grok filter that it doesn't like. Try commenting out pieces of the configuration to narrow down the cause of the error.