That's the output I get:
[ERROR] 2019-05-06 09:02:32.994 [[main]>worker2] ruby - Could not process event: undefined method `each' for nil:NilClass {:script_path=>"/home/christiane/splitData.rb", :class=>"NoMethodError", :backtrace=>["/home/christiane/splitData.rb:10:in `filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script/context.rb:55:in `execute_filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:98:in `file_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:84:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:143:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:162:in `block in multi_filter'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in `multi_filter'", "(eval):155:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:358:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:337:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:304:in `block in start_workers'"]}
[ERROR] 2019-05-06 09:02:33.003 [[main]>worker2] ruby - Ruby exception occurred: undefined method `[]' for nil:NilClass
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"path" => "/home/christiane/Dokumente/evtx_shortx.xml",
"@timestamp" => 2019-05-06T07:02:31.733Z,
"@metadata" => {
"host" => "christiane-ThinkPad-X240",
"path" => "/home/christiane/Dokumente/evtx_shortx.xml",
"theXML" => {
"Event" => [
[0] {
"xmlns" => "http://schemas.microsoft.com/win/2004/08/events/event",
"System" => {
"Execution" => {
"ThreadID" => "696",
"ProcessID" => "692"
},
"EventID" => {
"Qualifiers" => "",
"content" => "1089"
},
"Task" => "101",
"Security" => {
"UserID" => "S-1-5-18"
},
"Provider" => {
"Name" => "Microsoft-Windows-AAD",
"Guid" => "{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}"
},
"Level" => "2",
"Version" => "0",
"Channel" => "Microsoft-Windows-AAD/Operational",
"Keywords" => "0x4000000000000012",
"Opcode" => "0",
"Computer" => "xxx",
"TimeCreated" => {
"SystemTime" => "2019-02-01 15:08:46.508312"
},
"EventRecordID" => "19",
"Correlation" => {
"RelatedActivityID" => "",
"ActivityID" => "{0114a2a5-ba40-0001-b6a2-140140bad401}"
}
},
"EventData" => {
"Data" => {
"Name" => "Status",
"content" => "0xc00484b2"
}
}
},
[1] {
"xmlns" => "http://schemas.microsoft.com/win/2004/08/events/event",
"System" => {
"Execution" => {
"ThreadID" => "696",
"ProcessID" => "692"
},
"EventID" => {
"Qualifiers" => "",
"content" => "1104"
},
"Task" => "101",
"Security" => {
"UserID" => "S-1-5-18"
},
"Provider" => {
"Name" => "Microsoft-Windows-AAD",
"Guid" => "{4de9bc9c-b27a-43c9-8994-0915f1a5e24f}"
},
"Level" => "2",
"Version" => "0",
"Channel" => "Microsoft-Windows-AAD/Operational",
"Keywords" => "0x4000000000000012",
"Opcode" => "0",
"Computer" => "xxx",
"TimeCreated" => {
"SystemTime" => "2019-02-01 15:08:46.508322"
},
"EventRecordID" => "20",
"Correlation" => {
"RelatedActivityID" => "",
"ActivityID" => "{0114a2a5-ba40-0001-b6a2-140140bad401}"
}
},
"EventData" => {
"Data" => [
[0] {
"Name" => "API",
"content" => "Plugin initialize"
},
[1] {
"Name" => "Result",
"content" => "3221521586"
}
]
}
},