# Adding new field in Logstash 5.0.0\_rc1 with Ruby plugin

**URL:** <https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911>\
**Category:** Logstash\
**Created:** [October 25, 2016, 5:15pm UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911 "2016-10-25T17:15:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alesnav](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@alesnav](https://discuss.elastic.co/u/alesnav)\
**Post date:** [October 25, 2016, 5:15pm UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911/1 "2016-10-25T17:15:59Z")

</div>

Hello there!

I am trying to set up a new field called fingerprint for each event received by Logstash. This new field must be calculated using HMAC with sha256 and a salt.

I was able to configure it without any problems in Logstash 2.4, but I am not able to get it done using Logstash 5.0.0\_rc1.

`/etc/logstash/conf.d/filter-fingerprint.conf`:

````auto
 ruby {
  init => "require 'openssl'; require_relative '../scripts/hmac_key'"
  code => "event['fingerprint'] = OpenSSL::HMAC.hexdigest('sha256', KEY, event['message'])"
 }
}```

`/etc/logstash/scripts/hmac_key.rb`:

```KEY = "12345"```

If Logstash service is started with `--log.level=debug`, it shows the following messages:

```[2016-10-25T18:53:13,204][DEBUG][logstash.agent] 2016-10-25 18:53:13 +0200: Listen loop error: #<Errno::EBADF: Bad file descriptor - Bad file descriptor>
[2016-10-25T18:53:13,204][DEBUG][logstash.agent] org/jruby/RubyIO.java:3705:in `select'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:322:in `handle_servers'
/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:296:in `run'```

Are you able to use the Ruby filter plugin with the new Logstash 5.0.0_rc1?

Thanks,
Best regards
````

---

<div class="post-metadata">

**Author:** ![shog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shog/32/12138_2.png) [@shog](https://discuss.elastic.co/u/shog)\
**Post date:** [October 25, 2016, 6:30pm UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911/2 "2016-10-25T18:30:42Z")

</div>

> [@alesnav](#):
>
> code =\> "event['fingerprint'] = OpenSSL::HMAC.hexdigest('sha256', KEY, event['message'])"

Event API changed in alpha3, so you may want to take a look at [Event API | Logstash Reference [master] | Elastic](https://www.elastic.co/guide/en/logstash/master/event-api.html)

I guess your line should be more like (had no chance to test)

```auto
code => "event.set('fingerprint', OpenSSL::HMAC.hexdigest('sha256', KEY, event.get('message'))"

```

---

<div class="post-metadata">

**Author:** ![alesnav](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@alesnav](https://discuss.elastic.co/u/alesnav)\
**Post date:** [October 26, 2016, 8:02am UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911/3 "2016-10-26T08:02:23Z")

</div>

Thanks @shog,

Now it does work if I remove the `require_relative` and set a static value instead of `KEY` variable.

How can I load an external variable from this ruby filter configuration?

Best regards

EDIT: Ok, everything is working now. I must use the full path and use `require` instead of `require_relative` 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911/4 "2017-07-06T04:32:38Z")

</div>

Closed on July 6, 2017, 4:32am UTC