Logstash 2.2 private method 'gets' called on CSV parsing

[Dustman77]

I have a Logstash configuration that is working in 1.7 but is now showing errors in 2.2.

I get XML streamed via TCP and use the XML filter plugin to pull out the data in the XML. Some of the values in the XML is CSV data that I need to break out. The XML filter is working as expected and producing a field containing the expected CSV data.

xml {
  store_xml => "false"
  source => "message"
  xpath => [
    "/event/detail/anomaly/typeII/text()", "Anom_TypeII",
    "/event/detail/anomaly/typeI/text()", "Anom_TypeI",
    "/event/detail/TRAP/serial/text()", "TRAP_Serial",
    "/event/detail/TRAP/alarm/text()", "TRAP_Alarm",
    "/event/detail/TRAP/collector/text()", "TRAP_Collector",
    "/event/detail/TRAP/battery/text()", "TRAP_Battery",
    "/event/detail/TRAP/service/text()", "TRAP_Service",
    "/event/detail/TRAP/counts/text()", "TRAP_Counts",
    "/event/detail/TRAP/dot_threshold/text()", "DOT_Threshold",
    "/event/detail/TRAP/dot_output/text()", "DOT_Output",
    "/event/detail/TRAP/threat_names/text()", "Threat_Names"
  ]
}

I then us CSV to parse out the contents of the field.

csv {
  source => ["Threat_Names"]
  columns => ["Sig01_Name", "Sig02_Name", "Sig03_Name", "Sig04_Name", "Sig05_Name", "Sig06_Name", "Sig07_Name", "Sig08_Name", "Sig09_Name", "Sig10_Name" ]
  separator => ","
}

In the older version I would get new fields with the content for each portion of the CSV. Now I get a tag with _csvparsefailure and the message below in the logstash.log complaining about a private method getting called.

{:timestamp=>"2016-03-09T23:20:21.457000+0000", :message=>"Error parsing csv", :field=>"Threat_Names", :source=>["A211,B211,C211K2,G211,Ov1RfB50A3-0,Bg-SK2,Ova-SK2,Eh-SK2,,"], :exception=>#<NoMethodError: private methodgets' called for ["A211,B211,C211K2,G211,Ov1RfB50A3-0,Bg-SK2,Ova-SK2,Eh-SK2,,"]:Array>, :level=>:warn}`

If there is a configuration error please let me know but I believe because of the private method it is something in the plugin.

[Dustman77]

Is there any way I can do a bounty for this bug? If so please respond and I will use desired method

[suyograo]

@Dustman77 no need for a bounty :) we'll take a look at it soon.

[Dustman77]

Ahh sweet, thank you so much. If you need more info to reproduce please let me know.

On Mar 9, 2016, at 6:24 PM, Suyog Rao [email protected] wrote:

@Dustman77 no need for a bounty :) we'll take a look at it soon.

— Reply to this email directly or view it on GitHub.