Combining the referenced ruby filter code with Ruby conversion code, I'm trying out the following piece of code in my filter:
if(![srcIPv4] and [srcIPv6]) {
mutate { add_field => { "srcIPv4" => ""}}
ruby {
init => 'require "ipaddr"'
code => '
ipv6 = IPAddr.new(event.get("srcIPv6"))
event.set("srcIPv4",ipv6.native)'
}
}
I've used a workaround using [geoip][ip]
but I think I'm paying a high computational price for IPv6-to-IPv4 conversion.
The error that I'm getting in logstash's logs, because of this, is:
[2018-12-01T17:34:13,309][ERROR][logstash.filters.ruby ] Ruby exception occurred: Missing Converter handling for full class name=org.jruby.RubyObjectVar2, simple name=RubyObjectVar2
And a link with the Ruby code working in the tester.
Any help appreciated, thanks!