Creating an array of values via ruby on logstash config

Elastic Stack Logstash
1

Hello,

Im trying to get the cpu core values in a single array on my logstash config . I'm not familiar with ruby code, however based on my very limited understanding i was able to do this . It has the cpu core values , but not in an array .

What am i missing here ?

	dissect

	{
	mapping => {"message" => "%{time}|%{rest}all %{Overall_CPU_usage}%, %{CPU} TX %{TX_Value_Mbps} "}
	}

	}
	
	kv 
	{
	source => "CPU"
	value_split => " "
	remove_char_value => "%"
	}
	ruby
        {
        code => '
        cpu_core = []
        event.to_hash.each { |k, v|
	if k =~/^\d+$/
	cpu_core[k]=[v];
	end
	}
        event.set("CPU-Usage",cpu_core)
        '
        }
	}

OUTPUT

{
                   "c7" => "37,",
        "TX_Value_Mbps" => "198",
            "CPU-Usage" => [], <<<<<<<< #EMPTY ARRAY
           "@timestamp" => 2021-06-06T20:33:55.629Z,
                   "c3" => "36,",
                   "c1" => "44,",
                   "c5" => "42,",
                   "c2" => "31,",
                   "c4" => "38,",
    "Overall_CPU_usage" => "39",
                   "c0" => "41,",
                   "c6" => "44,",
}
2

Your keys do not match that pattern. They start with 'c'.

3

oops, i have modified it . here's the log that;s being parsed.

 c0 41%, c1 44%, c2 31%, c3 36%, c4 38%, c5 42%, c6 44%, c7 37%,

Modified the pattern accordingly

 ruby
        {
        code => '
        cpu_core = [ ]
        event.to_hash.each { |k, v|
        if k =~ /^c\d+$/ <<<< #modified to match pattern
        cpu_core[k]=[v];
        end
        }
        event.set("CPU-Usage",cpu_core)
        '
        }

Here's the error that's coming up now , should i need to convert the type ? if so , which parameter should i convert ?

[2021-09-08T17:40:24,711][ERROR][logstash.filters.ruby    ][main][d7d2363fc83aadaee3b0a7fcf3a592e8a5614618c839c950ef7677afd933b026] Ruby exception occurred: no implicit conversion of String into Integer {:class=>"TypeError", :backtrace=>["org/jruby/RubyArray.java:1568:in `[]='", "(ruby filter code):6:in `block in filter_method'", "org/jruby/RubyHash.java:1415:in `each'", "(ruby filter code):4:in `block in filter_method'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:93:in `inline_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:86:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start_workers'"]}
{
           "@timestamp" => 2021-06-06T20:33:55.629Z,
                   "c5" => "42,",
                   "c0" => "41,",
                   "c6" => "44,",
        "TX_Value_Mbps" => "198",
                   "c7" => "37,",
                   "c2" => "31,",
                   "c1" => "44,",
                   "c3" => "36,",
                   "c4" => "38,"
}
4

You cannot use "c5" as an array index. You will need to remove the "c", also you will want to remove the comma from the value. Instead of

cpu_core[k]=[v]

you could try

cpu_core[k.sub(/^c/, "").to_i]=[v.sub(/,$/, "").to_i]
1 Like
5

Thank you @Badger , works as expected :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.