Adding new field in Logstash 5.0.0_rc1 with Ruby plugin

Elastic Stack Logstash
1

Hello there!

I am trying to set up a new field called fingerprint for each event received by Logstash. This new field must be calculated using HMAC with sha256 and a salt.

I was able to configure it without any problems in Logstash 2.4, but I am not able to get it done using Logstash 5.0.0_rc1.

/etc/logstash/conf.d/filter-fingerprint.conf:

 ruby {
  init => "require 'openssl'; require_relative '../scripts/hmac_key'"
  code => "event['fingerprint'] = OpenSSL::HMAC.hexdigest('sha256', KEY, event['message'])"
 }
}```



`/etc/logstash/scripts/hmac_key.rb`:

```KEY = "12345"```

If Logstash service is started with `--log.level=debug`, it shows the following messages:

```[2016-10-25T18:53:13,204][DEBUG][logstash.agent           ] 2016-10-25 18:53:13 +0200: Listen loop error: #<Errno::EBADF: Bad file descriptor - Bad file descriptor>
[2016-10-25T18:53:13,204][DEBUG][logstash.agent           ] org/jruby/RubyIO.java:3705:in `select'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `run'```

Are you able to use the Ruby filter plugin with the new Logstash 5.0.0_rc1?

Thanks,
Best regards
2

Event API changed in alpha3, so you may want to take a look at Event API | Logstash Reference [master] | Elastic

I guess your line should be more like (had no chance to test)

code => "event.set('fingerprint', OpenSSL::HMAC.hexdigest('sha256', KEY, event.get('message'))"
3

Thanks @shog,

Now it does work if I remove the require_relative and set a static value instead of KEY variable.

How can I load an external variable from this ruby filter configuration?

Best regards

EDIT: Ok, everything is working now. I must use the full path and use require instead of require_relative :wink: