Adding tags after executing ruby code filter

Hi,
I have a filter which check all inbound fields for leading underscores and if it finds any changes the underscore to other text.

I'd like to tag messages that have been modified with a tag. How do I do this? Atm, this tag is marking everything as modified regardless of whether it was changed or not.

Regards,
David

1 Like

Yeah, judging by the code below add_tag and add_field will always trigger. You'd have to add the tag in your Ruby code, e.g. like this:

(event['tags'] ||= []) << 'mytag'
1 Like

What does this syntax mean:

(event['tags'] ||= ) << 'mytag'

It works perfectly, just don't understand it...

It's a shorter (and less legible) way of saying

if event['tags']
  event['tags'] << 'mytag'
else
  event['tags'] = ['mytag']
end

It works like this: If event['tags'] is truthy the parenthesized expression evaluates to event['tags'] and we append "mytag". If it's not truthy it's ORed with an empty list (effectively initializing event['tags'] with that list) and then the expression evaluates to that.

4 Likes

Any suggestions on how can I extend this to work for Logstash 5.x? In Logstash 5.x, direct field references have been disabled in favor of using event get and set methods.

Thanks.

Just use event.tag('mytag'). See https://github.com/elastic/logstash/blob/master/logstash-core-event/lib/logstash/event.rb for the full event API.

1 Like

Thank you very much! Works perfectly.