Detect if event.get("message").scan fails

Elastic Stack Logstash
1

Hello All,

i would like to detect if "pattternmatch4" fails and do another process. How can i detect if it fails?

      ruby { code => 'event.set("patternmatch3", 
                      event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/))'
      }

      ruby { code => 'event.set("patternmatch4", 
                      event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/))'
      }

Best

2

If scan does not match anything I believe it will return nil, so you can test for that.

3

Thank you Badger,

could you give a code example? Maybe with and if statement, i am a newbie handling ruby

Best

4

My try is not working,

  if [patternmatch4] == nil {

  } else { 
     
  }
5

Try something like

ruby {
    code => '
        p = event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/)
        if p
            event.set("patternmatch4", p)
        end
    '
}
6

Thanks Badger,

how can set a "0" value to "patternmatch4" if not match?. My try is not working...

ruby { code => '

                x = "0"
                p = event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/)

                if p
                  event.set("patternmatch4", p)
                else
                  event.set("patternmatch4", x)
                end 
        '
  }

   mutate {
    add_field => {"field" => "%{[patternmatch4][-1]}"}
   }
7

I would expect that to work. What does patternmatch4 get set to?

8

I' added more code to my example, what i need if the pattern is not matching i set a value of "0" on a field in the document. The pattern is can be match with several lines. The [-1] is because if matched i want to retrieve tha last match in the patternmatch4 array.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.