some case, I want run ruby code in logstash or exec command, but it can modify and read any thing in host, if I expose some api for user modify logstash filters, it maybe not safity. so is there a way to run it in sandbox? thanks.
No; there is not. The entire Ruby VM is functionally accessible to plugins that execute ruby.