Array not getting accepted for "filters" parameter? Plugin:logstash-input-cloudwatch

[skerkar (Sid)]

Hi,

I am trying to fetch metrics for ES using "logstash-input-cloudwatch" plugin. As per docs, "filters" configuration is of 'array' type.
For fetching ES metrics, I need to pass DomainName and ClientId both, but plugin is throwing an error for datatype.
Examples on documentation page shows value as hash rather than array.
https://www.elastic.co/guide/en/logstash/6.6/plugins-inputs-cloudwatch.html#plugins-inputs-cloudwatch-filters.

I have tried below values for filters, but none worked:

filters => { "DomainName" => "DOMAIN_NAME", "ClientId" => "ACCOUNT_ID" }

filters => [{ "DomainName" => "DOMAIN_NAME"}, {"ClientId" => "ACCOUNT_ID" }]

Can anybody please suggest on this?

Thanks

[Badger]

Given the way it is used, the only format that makes sense to me is an array of arrays

filters => [ [ "DomainName", "DOMAIN_NAME"], ["ClientId", "ACCOUNT_ID"] ]

[skerkar (Sid)]

Thanks a lot @Badger.

Configuration file is accepted now with multiple filters, but script is failing at next stage with below error:

Error: undefined method each_pair' for #<Array:0x6f71fa5c> Did you mean? each_entry Exception: NoMethodError Stack: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-cloudwatch-2.2.4/lib/logstash/inputs/cloudwatch.rb:179:in from_resources'
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-cloudwatch-2.2.4/lib/logstash/inputs/cloudwatch.rb:163:in block in run' org/jruby/RubyArray.java:1734:in each'
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-cloudwatch-2.2.4/lib/logstash/inputs/cloudwatch.rb:157:in run' /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426:in inputworker'
/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:420:in `block in start_input'

Is it something related to multiple filters?

[Badger]

Yeah. The code is inconsistent. It declares filters as an array, and if you want multiple filters this means it has to be an array. However, all of the documentation shows it as a hash and this line of code means it has to be a hash. I would say that is a bug and you should mention this on that github issue you replied to a few hours back.

[skerkar (Sid)]

Thanks @Badger.

I tried debugging the plugin source code but I don't have knowledge about ruby so couldn't find much.
Thanks for your pointers.