# Delete file in ruby filter logstash

**URL:** <https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671>\
**Category:** Logstash\
**Created:** [November 19, 2021, 9:59am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671 "2021-11-19T09:59:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hertz\_Drive](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hertz_drive/32/96228_2.png) [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\
**Post date:** [November 19, 2021, 9:59am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/1 "2021-11-19T09:59:23Z")

</div>

my code in ruby filter

```auto
def register(params)
   print "heello ruby come in"
end

def filter(event)

Dir.glob('/home/hz/COM.txt').each { |file|
    File.chmod(0777, file)
    File.delete(file)
    print(file)
}
  #return []
  return [event]
end

```

ERROR in stdout

```auto
logstash[19660]: [2021-11-19T16:45:12,113][ERROR][logstash.filters.ruby][main][700d5ddcd52a61f50fb0e3a254bbc3a885efe735d74966f842dfa7875da6162b] Could not process event: Operation not permitted - No message available {:script_path=>"/etc/logstash/lol.rb", :class=>"Errno::EPERM", :backtrace=>["org/jruby/RubyFile.java:644:in `chmod'", "/etc/logstash/lol.rb:9:in `block in filter'", "org/jruby/RubyArray.java:1820:in `each'", "/etc/logstash/lol.rb:8:in `filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script/context.rb:55:in `execute_filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:107:in `file_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:88:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start_workers'"]}

```

help me please i need delete file when filebeat read complete after 1 week check time in log file

Sorry english not good.

Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 19, 2021, 5:52pm UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/2 "2021-11-19T17:52:48Z")

</div>

You do not have permission to chmod the file. On the systems I use only root and the owner of a file can chmod it.

Why chmod the file? Permission to "delete the file" is really permission to remove the directory entry, so it requires write access to the directory, not the file. I suggest you remove the chmod.

---

<div class="post-metadata">

**Author:** ![Hertz\_Drive](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hertz_drive/32/96228_2.png) [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\
**Post date:** [November 22, 2021, 3:39am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/3 "2021-11-22T03:39:35Z")

</div>

it's not work .

my code

```auto
def register(params)
   print "heello ruby come in"
end

def filter(event)

Dir.glob('/home/hz/COM.txt').each { |file|
    #File.chmod(0777, file)
    File.delete(file)
    print(file)
}
  #return []
  return [event]
end

```

Error stdout

```auto
[[ANov 22 10:34:48 ubuntu logstash[5775]: [2021-11-22T10:34:48,198][ERROR][logstash.filters.ruby][ssl][26232457a7164f58d039862d53f207a13dc5147ec97dd7e3cf1ca347b2523c5c] Could not process event: Permission denied - /home/hz/COM.txt {:script_path=>"/etc/logstash/lol.rb", :class=>"Errno::EACCES", :backtrace=>["org/jruby/RubyFile.java:1293:in `delete'", "/etc/logstash/lol.rb:10:in `block in filter'", "org/jruby/RubyArray.java:1820:in `each'", "/etc/logstash/lol.rb:8:in `filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script/context.rb:55:in `execute_filter'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby/script.rb:30:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:107:in `file_script'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:88:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1820:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:295:in `block in start_workers'"]}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 22, 2021, 3:59am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/4 "2021-11-22T03:59:14Z")

</div>

That would suggest that you do not have write access to the /home/hz directory, or that it is mounted on a read-only file system.

---

<div class="post-metadata">

**Author:** ![Hertz\_Drive](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hertz_drive/32/96228_2.png) [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\
**Post date:** [November 22, 2021, 4:04am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/5 "2021-11-22T04:04:44Z")

</div>

How to add permission to path.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 22, 2021, 4:20am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/6 "2021-11-22T04:20:44Z")

</div>

Perhaps chmod the directory instead of the file, but if the filesystem is read-only then that will not fix things.

---

<div class="post-metadata">

**Author:** ![Hertz\_Drive](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hertz_drive/32/96228_2.png) [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\
**Post date:** [November 22, 2021, 4:28am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/7 "2021-11-22T04:28:53Z")

</div>

it's work.

Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2021, 4:29am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671/8 "2021-12-20T04:29:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.