Delete file in ruby filter logstash

Elastic Stack Logstash
1

my code in ruby filter

def register(params)
   print "heello ruby come in"
end


def filter(event)

Dir.glob('/home/hz/COM.txt').each { |file|
    File.chmod(0777, file)
    File.delete(file)
    print(file)
}
  #return []
  return [event]
end

ERROR in stdout

logstash[19660]: [2021-11-19T16:45:12,113][ERROR][logstash.filters.ruby    ][main][700d5ddcd52a61f50fb0e3a254bbc3a885efe735d74966f842dfa7875da6162b] Could not process event: Operation not permitted - No message available {:script_path=>"/etc/logstash/lol.rb", :class=>"Errno::EPERM", :backtrace=>["org/jruby/RubyFile.java:644:in `chmod'", "/etc/logstash/lol.rb:9:in `block in filter'", "org/jruby/RubyArray.java:1820:in `each'", "/etc/logstash/lol.rb:8:in `filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script/context.rb:55:in `execute_filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:107:in `file_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:88:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start_workers'"]}

help me please i need delete file when filebeat read complete after 1 week check time in log file

Sorry english not good.

Thank you.

2

You do not have permission to chmod the file. On the systems I use only root and the owner of a file can chmod it.

Why chmod the file? Permission to "delete the file" is really permission to remove the directory entry, so it requires write access to the directory, not the file. I suggest you remove the chmod.

3

it's not work .

my code

def register(params)
   print "heello ruby come in"
end


def filter(event)

Dir.glob('/home/hz/COM.txt').each { |file|
    #File.chmod(0777, file)
    File.delete(file)
    print(file)
}
  #return []
  return [event]
end

Error stdout

[[ANov 22 10:34:48 ubuntu logstash[5775]: [2021-11-22T10:34:48,198][ERROR][logstash.filters.ruby    ][ssl][26232457a7164f58d039862d53f207a13dc5147ec97dd7e3cf1ca347b2523c5c] Could not process event: Permission denied - /home/hz/COM.txt {:script_path=>"/etc/logstash/lol.rb", :class=>"Errno::EACCES", :backtrace=>["org/jruby/RubyFile.java:1293:in `delete'", "/etc/logstash/lol.rb:10:in `block in filter'", "org/jruby/RubyArray.java:1820:in `each'", "/etc/logstash/lol.rb:8:in `filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script/context.rb:55:in `execute_filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:107:in `file_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:88:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start_workers'"]}
4

That would suggest that you do not have write access to the /home/hz directory, or that it is mounted on a read-only file system.

5

How to add permission to path.

6

Perhaps chmod the directory instead of the file, but if the filesystem is read-only then that will not fix things.

7

it's work.

Thank you very much.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.