logstash 2.3 and conditional filter broken?

[dvic]

Hi,

With 2.3.x, I am getting the following error if I have a conditional statement in the filter:

logstash-dev | {:timestamp=>"2016-04-01T09:15:27.669000+0000", :message=>"Pipeline main started"}
logstash-dev | {:timestamp=>"2016-04-01T09:15:32.418000+0000", :message=>"Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.", "exception"=>#<NoMethodError: undefined method `multi_filter' for nil:NilClass>, "backtrace"=>["(eval):84:in `cond_func_1'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):81:in `cond_func_1'", "(eval):68:in `filter_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:271:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:269:in `filter_batch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:227:in `worker_loop'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:205:in `start_workers'"], :level=>:error}
logstash-dev | NoMethodError: undefined method `multi_filter' for nil:NilClass
logstash-dev |     cond_func_1 at (eval):84
logstash-dev |            each at org/jruby/RubyArray.java:1613
logstash-dev |     cond_func_1 at (eval):81
logstash-dev |     filter_func at (eval):68
logstash-dev |    filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:271
logstash-dev |            each at org/jruby/RubyArray.java:1613
logstash-dev |          inject at org/jruby/RubyEnumerable.java:852
logstash-dev |    filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:269
logstash-dev |     worker_loop at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:227
logstash-dev |   start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/pipeline.rb:205
logstash-dev exited with code 1

I am running it with the following config ($PWD/logstash-dev.conf):

input {
  tcp {
    port => 12201
    type => "t"
  }
  udp {
    port => 12202
    type => "u"
  }
}

filter {
  if [type] == "u" {
    mutate {
      add_field => { "testje" => 123 }
    }
  } else {
    mutate {
      add_field => { "testje" => 456 }
    }
  }
}
output {
  stdout {
    codec => rubydebug
  }
}

I get this both with the vanilla zip installation as well as the docker image, I'm using this docker-compose setup:

version: '2'

services:
  logstash:
    container_name: logstash-dev
    image: logstash:2.3
    command: logstash -f /etc/logstash/logstash-dev.conf --auto-reload
    volumes:
      - ${PWD}/logstash-dev.conf:/etc/logstash/logstash-dev.conf:ro
    ports:
      - 192.168.99.100:12201:12201/tcp
      - 192.168.99.100:12201:12201/udp
      - 192.168.99.100:12202:12202/tcp
      - 192.168.99.100:12202:12202/udp

Is there something I'm missing or is this a bug introduced in the new version?

[jsvd]

confirmed as a bug, working on a fix. thanks for reporting

[jsvd]

fixed by #4970

[jsvd]

this patch will be included in the next version, 2.3.1