# Create new event in ruby filter

**URL:** <https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528>\
**Category:** Logstash\
**Created:** [September 22, 2017, 6:22pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528 "2017-09-22T18:22:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vl.zemtsov](https://avatars.discourse-cdn.com/v4/letter/v/eb9ed0/32.png) [@vl.zemtsov](https://discuss.elastic.co/u/vl.zemtsov)\
**Post date:** [September 22, 2017, 6:22pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/1 "2017-09-22T18:22:57Z")

</div>

Hi.

I cant create new event in fuby filter.

(Use logstash 5.6.0)

In filter:

> ```
> filter {
> ruby {
> code => "        
> yield LogStash::Event.new(
> 'timestamp' => event.get('timestamp'),
> 'test_field' => 'value_test_field'
> )
> "
> }
> }
> 
> ```

But in logs:

> [ERROR] 2017-09-22 13:39:25.787 [[main]\>worker7] ruby - Ruby exception occurred: **yield called out of block**

I find - [configuration - Logstash dynamically split events - Stack Overflow](https://stackoverflow.com/questions/26074782/logstash-dynamically-split-events). But i cant understand how it work. And how it use in ruby filter.

---

<div class="post-metadata">

**Author:** ![vl.zemtsov](https://avatars.discourse-cdn.com/v4/letter/v/eb9ed0/32.png) [@vl.zemtsov](https://discuss.elastic.co/u/vl.zemtsov)\
**Post date:** [September 23, 2017, 2:31pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/2 "2017-09-23T14:31:11Z")

</div>

If i use event.clone if filter:

> ```
> > ruby {
> > code => "        
> > new_event = event.clone
> > yield new_event
> > "
> > }
> 
> ```

I again get this error:

> [ERROR] 2017-09-23 10:29:39.216 [[main]\>worker7] ruby - Ruby exception occurred: **yield called out of block**

---

<div class="post-metadata">

**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Post date:** [September 23, 2017, 2:53pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/3 "2017-09-23T14:53:18Z")

</div>

Please use Event API, by [SET API](https://www.elastic.co/guide/en/logstash/current/event-api.html) you can achieve this

---

<div class="post-metadata">

**Author:** ![vl.zemtsov](https://avatars.discourse-cdn.com/v4/letter/v/eb9ed0/32.png) [@vl.zemtsov](https://discuss.elastic.co/u/vl.zemtsov)\
**Post date:** [September 23, 2017, 3:14pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/4 "2017-09-23T15:14:12Z")

</div>

Hmm.

I need create new Event, for output.

So that when input processed 1 incoming message (event). Output received 2 (or more) event.

With Event API i can create new field. Not event.

---

<div class="post-metadata">

**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Post date:** [September 23, 2017, 3:28pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/5 "2017-09-23T15:28:59Z")

</div>

if you want to clone then you can use clone filter or a mutate filter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2017, 3:29pm UTC](https://discuss.elastic.co/t/create-new-event-in-ruby-filter/101528/6 "2017-10-21T15:29:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.