Compare two fields

Elastic Stack Logstash
1

Hello Guys,

Just want to know if below condition will work or possible?

filter {
ruby {
code => "
event.set('dateko', Time.now.strftime('%Y-%m-%d'))
"
}
if [dateko] not in [message] {
.......
}
}

2

Syntax-wise that looks fine. Why ask when you can try it out?

3

thanks Magnus, sorry i have a running config in production. just want to add that condition. I've tested it now and it seemed to work. Also it's available on the docu online

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

Btw, I have this ruby code

	ruby {
		code => "
		event.set('datemo', DateTime.yesterday.strftime('%Y-%m-%d'))
		"
	 }

But i've encountered this error on logstash logs, could you help me pls what was wrong here.

[2017-12-04T06:20:50,922][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method yesterday' for DateTime:Class [2017-12-04T06:20:50,926][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined methodyesterday' for DateTime:Class
[2017-12-04T06:20:50,927][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method yesterday' for DateTime:Class [2017-12-04T06:20:50,928][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined methodyesterday' for DateTime:Class
[2017-12-04T06:20:50,929][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method yesterday' for DateTime:Class [2017-12-04T06:20:50,931][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined methodyesterday' for DateTime:Class
[2017-12-04T06:20:50,934][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `yesterday' for DateTime:Class

4

sorry i have a running config in production. just want to add that condition.

You need to have a usable test environment.

Ruby exception occurred: undefined method `yesterday' for DateTime:Class

Well, the standard DateTime class doesn't have a yesterday method. I don't know Ruby well enough to give a good countersuggestion.

5

thanks magnus for the advise. yes i'll set a test env for this.

this one is working to get the current date.

          ruby {
          code => "
          event.set('dateko', Time.now.strftime('%Y-%m-%d'))
          "
          }

this one is not for yesterday's date

        ruby {
	code => "
	event.set('datemo', DateTime.yesterday.strftime('%Y-%m-%d'))
	"
        }
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.