# Custome Logstash Filter Plugin Parameter Problem

**URL:** <https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166>\
**Category:** Logstash\
**Created:** [October 5, 2018, 7:09am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166 "2018-10-05T07:09:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nww\_Pot\_Fung\_Nng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nww_pot_fung_nng/32/128628_2.png) [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\
**Post date:** [October 5, 2018, 7:09am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/1 "2018-10-05T07:09:20Z")

</div>

I am writing a logstash filter plugin. It takes a payload and generates a jwt token, and looks like this.

```
  gentoken {
    payload => {
      "userid" => '%{userid}'
      "role" => '%{role}'
    }
    secret => "3053565582"
    alg => "HS256"
  }

```

Then, a token field will be created and the event will be inserted into elasticsearch cluster.

I found that all token generated are having the same userid, role, module value that the filter is called.

e.g .  
message1: foo,role1  
message2: bar,role2  
message3: boo,role3

All tokens generated will have 'foo' and 'role1' as the userid and role.

I followed the guide [https://www.elastic.co/guide/en/logstash/current/\_how\_to\_write\_a\_logstash\_filter\_plugin.html](https://www.elastic.co/guide/en/logstash/current/_how_to_write_a_logstash_filter_plugin.html).

In the rb file, I have something like this

config :payload, :validate =\> :hash, :default =\> {}

'#accessing the @payload parameter and then convert it back to hash

t\_payload = eval(event.sprintf(@payload))

t\_payload.each do |field, value|  
payload.store(event.sprintf(field), event.sprintf(value))  
end

...

Please kindly help.  
nww

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2018, 7:12am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/2 "2018-10-05T07:12:49Z")

</div>

> t\_payload = eval(event.sprintf(@payload))

What are you trying to accomplish here?

---

<div class="post-metadata">

**Author:** ![Nww\_Pot\_Fung\_Nng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nww_pot_fung_nng/32/128628_2.png) [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\
**Post date:** [October 5, 2018, 7:15am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/3 "2018-10-05T07:15:26Z")

</div>

I am thinking of accessing @payload using event.sprintf instead of direct reference. Below is my previous attempt. But, it doesn't work.

@payload.each do |field, value|  
payload.store(event.sprintf(field), event.sprintf(value))  
end

---

<div class="post-metadata">

**Author:** ![Nww\_Pot\_Fung\_Nng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nww_pot_fung_nng/32/128628_2.png) [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\
**Post date:** [October 5, 2018, 7:22am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/4 "2018-10-05T07:22:44Z")

</div>

Below is my complete rb file.

```
# encoding: utf-8
require "logstash/filters/base"
require "logstash/namespace"
require "jwt"

# This filter is created base on the example from github. It will
# generate a json web token from the given payload and base64 coded
# it. The enocded token will be add the the event 'token' field.
#
class LogStash::Filters::GenToken < LogStash::Filters::Base

  # Setting the config_name here is required. This is how you
  # configure this filter from your Logstash config.
  #
  # filter {
  # gentoken {
  # payload {
  # "field1" => "value1"
  # "field2" => "value2"
  # ...
  # }
  # secret => "mysecret"
  # alg => "HS256"
  # }
  # }
  #
  config_name "gentoken"

  # Parameters
  config :payload, :validate => :hash, :default => {}
  config :secret, :validate => :string, :required => true
  config :alg, :validate => :string, :default => "HS256"

  #time lapsed before the token expired, default to 4 hours
  config :lapse, :validate => :number, :default => 14400

  public
  def register
    # Add instance variables
  end # def register

  public
  def filter(event)
    # accessing the @payload parameter and then convert it back to hash
    t_payload = eval(event.sprintf(@payload))
    if t_payload
      # Generate JWT from the payload and base64 encoded it.

      # Read all fields passed in and put it in a new hash
      t_payload.each do |field, value|
        @logger.debug? && @logger.debug("payload: ", :field => event.sprintf(field), :value => event.sprintf(value) )
        payload.store(event.sprintf(field), event.sprintf(value))
      end

      #work out the token expired time
      exp = Time.now.to_i + lapse

      payload.store("exp", exp)

      @logger.debug? && @logger.debug("payload: ", :payload => payload)

      # using the event.set API
      event.set("token", Base64.urlsafe_encode64(JWT.encode payload, @secret, @alg))

      # correct debugging log statement for reference
      # using the event.get API
      @logger.debug? && @logger.debug("token is now: #{event.get("token")}")
    end

    # filter_matched should go in the last line of our successful code
    filter_matched(event)
  end # def filter
end # class LogStash::Filters::GenToken
```

---

<div class="post-metadata">

**Author:** ![Nww\_Pot\_Fung\_Nng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nww_pot_fung_nng/32/128628_2.png) [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\
**Post date:** [October 5, 2018, 11:27am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/5 "2018-10-05T11:27:39Z")

</div>

After a few times of build and install, build and install, the codes work now... Don't know what went wrong...

---

<div class="post-metadata">

**Author:** ![Nww\_Pot\_Fung\_Nng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nww_pot_fung_nng/32/128628_2.png) [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\
**Post date:** [October 6, 2018, 1:28am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/6 "2018-10-06T01:28:48Z")

</div>

And I only need this.

> @payload.each do |field, value|  
> payload.store(event.sprintf(field), event.sprintf(value))  
> end

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2018, 1:28am UTC](https://discuss.elastic.co/t/custome-logstash-filter-plugin-parameter-problem/151166/7 "2018-11-03T01:28:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.