NoMethodError: undefined method `to_iso8601' for nil:NilClass in event.rb

_From @emmanuelGuiton on October 13, 2015 12:24_

Hello,

I used a logstash 1.5.4 instance that processes a few tens of millions messages per day and that often crashes (almost once everyday). In logstash.err, ther is the following trace :

Oct 09, 2015 9:58:17 AM org.apache.http.impl.execchain.RetryExec execute
INFO: Retrying request to {}->http://10.176.61.21:9200
NoMethodError: undefined method `to_iso8601' for nil:NilClass
to_s at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/event.rb:109
retry_flush at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:729
times at org/jruby/RubyFixnum.java:275
each at org/jruby/RubyEnumerator.java:274
map at org/jruby/RubyEnumerable.java:764
retry_flush at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:724
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-1.0.7-java/lib/logstash/outputs/elasticsearch.rb:480

Looking at elasticsearch.rb, the application crashes while trying to log an error :
@logger.error "too many attempts at sending event. dropping: #{next_event}"

Looking at event.rb, the to_s function (called when trying to log the event) assumes there is an existing timestamp field. But from the trace I suspect this field does not always exist. So Logstash crashes when trying to call to_is8601 on a non-existing timestamp.

The fix seems simple : testing if the timestamp field exists before trying to call its to_iso8601 method.
Sorry, I cannot submit a patch since I do not know anything about ruby.

_Copied from original issue: elastic/elasticsearch#14086_