Annoying - filter ruby code multiplication doesnt work

Elastic Stack Logstash
1

Can anyone please help with this ... its annoying me no end :slight_smile:

field cpu.user_p=0.45

This filter works and allocates cpu_user_p=45

ruby
{ code => "event['cpu_user_p'] = 0.45 * 100" }

This filter doesnt work, and cpu_user_p=0

ruby
{ code => "event['cpu_system_p'] = event['cpu.user_p'].to_f * 100" }

2

which version of logstash are you using? this, including your full configuration will be required to know more about your problem, I just did a quick check and

skywalker% ./logstash-2.3.0/bin/logstash -f ruby.conf
Settings: Default pipeline workers: 4
Pipeline main started
{
    "cpu_user_p" => 45.0,
       "message" => "Hello world!",
    "@timestamp" => 2016-06-08T14:24:29.149Z,
          "host" => "skywalker",
      "sequence" => 0,
      "@version" => "1"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
skywalker%

this is what you get with

input {
  generator { count => 1}
}

filter {
 ruby { 
    code => "event['cpu_user_p'] = 0.45 * 100"
  }
}

output {
  stdout { codec => rubydebug }
}

is your issue because in your first code you use cpu_user_p while in the second you use 'cpu.user_p see the dot after cpu vs the underscore in the first part.

3

Hi Pere,

Thanks for the reply.

Top beat event['cpu.user_p'] (with a dot gives a percentage as a decimal it uses 0.01 to represent 1%

I want to multiply it by 100 so that it is a true percentage. If I can retain the field name of cpu.user_p then so much the better. Thought it safer to change the . to an _ while I test it so that I can see both versions. So the intention was that the new true percentage would be called cpu_user_p

Seems to work OK as your program below. However when using it with input from topbeat cpu_user_p is always 0, and I cant understand why. I thought that using to_f would cast it to a float in logstash if it was not already if that type ?

The logstash version is 2.2.2

This file:

input {
generator { count => 1}
}

filter {
mutate {
add_field => { "cpu.user_p" => 0.05 }
}

ruby {
code => "event['cpu_user_p'] = event['cpu.user_p'].to_f * 100"
}
}

output {
stdout { codec => rubydebug }
}

gives an output as below(i.e. working) But this doent work when the input cpu.user_p comes from topbeat and =0.05.

Settings: Default pipeline workers: 2
Logstash startup completed
{
"message" => "Hello world!",
"@version" => "1",
"@timestamp" => "2016-06-08T17:57:27.216Z",
"host" => "servername",
"sequence" => 0,
"cpu.user_p" => "0.05",
"cpu_user_p" => 5.0
}
Logstash shutdown completed

4

I think that the issue might be that cpu.user_p is part of a JSON document as shown below.

So when I try to reference cpu.user_p in logstash I'm guessing it doesnt recognise it as the name of a field as such ?

How would I change cpu.user_p from float like 0.07 to 7 i.e. multiply by 100 if it is part of a JSON document ?

Any help with this much appreciated.

Thanks

Mick

{
"_index": "logstashsystem-2016.06.08",
"_type": "system",
"_id": "AVUxwZ29nE6fvOfjobS-",
"_score": null,
"_source": {
"@timestamp": "2016-06-08T20:43:39.209Z",
"beat": {
"hostname": "servername",
"name": "servername"
},
"cpu": {
"idle": 359180971,
"iowait": 211944,
"irq": 91,
"nice": 54369,
"softirq": 33274,
"steal": 0,
"system": 2280639,
"system_p": 0.0045,
"user": 4354223,
"user_p": 0.011
},
"load": {
"load1": 0.03,
"load15": 0.02,
"load5": 0.06
},
"mem": {
"actual_free": 7773220864,
"actual_used": 478752768,
"actual_used_p": 0.06,
"free": 3124805632,
"total": 8251973632,
"used": 5127168000,
"used_p": 0.62
},
"swap": {
"free": 2147479552,
"total": 2147479552,
"used": 0,
"used_p": 0
},

5

Have re-raised this as per below link as I understand the issue more now