When I want to use the 'count' value in metric, it returns nilClass

[eastmxc (Xiaocai Mu)]

I'm doing some test, my filter is like the following:

filter{
    grok{
        patterns_dir => ["./my_pattern"]
        match => ["message","%{MY_PATTERN:ppp}"]
        remove_field => ["message"]
        add_tag => "warn"
    }
    metrics{
        meter => "events_%{ppp}"
        add_tag => "metric"
    }
    if "metric" in [tags]{
        ruby{
           code => 'event.cancel if event.get("[event_qwert][count]") < 5'
        }
    }
}

But when I run it, I always get a ruby exception like this:

[2016-12-27T18:42:59,080][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `<' for nil:NilClass

I'm sure the value exists, this is the output:

{
      "@timestamp" => 2016-12-27T23:42:59.058Z,
        "@version" => "1",
    "events_qwert" => {
         "rate_1m" => 0.2,
        "rate_15m" => 0.2,
           "count" => 1,
         "rate_5m" => 0.2
    },
         "message" => "netdm-2",
            "tags" => [
        [0] "metric",
        [1] "_rubyexception"
    ]
}

so, what's wrong with my configuration? Why can't it get the value?

[jsvd (João Duarte)]

@eastmxc

event.get("[event_qwert][count]")

in your config you have: meter => "events_%{ppp}"

So the ruby code is missing an "s" in the getter, should be event.get("[events_qwert][count]")

[eastmxc (Xiaocai Mu)]

Ooops! It's really a fool mistake.....and sometimes it's hard to detected by oneself. Anyway, thanks a lot!!!