Create new event in ruby filter

Elastic Stack Logstash
1

Hi.

I cant create new event in fuby filter.

(Use logstash 5.6.0)

In filter:

filter {
    ruby {
        code => "        
            yield LogStash::Event.new(
                'timestamp' => event.get('timestamp'),
                'test_field' => 'value_test_field'
            )
        "
    }
}

But in logs:

[ERROR] 2017-09-22 13:39:25.787 [[main]>worker7] ruby - Ruby exception occurred: yield called out of block

I find - configuration - Logstash dynamically split events - Stack Overflow. But i cant understand how it work. And how it use in ruby filter.

2

If i use event.clone if filter:

> ruby {
>     code => "        
>         new_event = event.clone
>         yield new_event
>     "
> }

I again get this error:

[ERROR] 2017-09-23 10:29:39.216 [[main]>worker7] ruby - Ruby exception occurred: yield called out of block

3

Please use Event API, by SET API you can achieve this

4

Hmm.

I need create new Event, for output.

So that when input processed 1 incoming message (event). Output received 2 (or more) event.

With Event API i can create new field. Not event.

5

if you want to clone then you can use clone filter or a mutate filter

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.