here is the result without the "mutate statement"
[2018-11-22T13:51:46,936][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://helk-elasticsearch:9200/"}
[2018-11-22T13:51:47,224][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the type event field won't be used to determine the document _type {:es_version=>6}
[2018-11-22T13:51:47,281][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 1001, column 21 (byte 34820) after filter {\nif [log_name] == "Microsoft-Windows-Sysmon/Operational"{\n ruby {\n\t code =>"\n event['processcreate'] = event['process_command_line'].length\n\t}\n \n }\n}\n# HELK winevent-security filter conf file\n# HELK build Stage: Alpha\n# Author: Roberto Rodriguez (@Cyb3rWard0g)\n# License: GPL-3.0\n\nfilter {\n if [log_name] == "", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:inblock in converge_state'"]}
is there anywhere i can find some guidance on how to write the ruby code sections? is the "event" variable usable here at all?