# Error with ruby filter plugin
**URL:** https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081
**Category:** Logstash
**Created:** [November 25, 2018, 4:53am UTC](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081 "2018-11-25T04:53:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ou\_snaaksie](https://discuss.elastic.co/u/ou_snaaksie)
#### Post date: [November 25, 2018, 4:53am UTC](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081/1 "2018-11-25T04:53:45Z")
I am receiving errors I can't solve, since my config seems correct to me. It is complaining about the use of the `ruby` filter plugin, but the ruby code is valid.
```
input {
beats {
port => 5443
}
}
filter {
ruby {
code => "event.set('filename', event.get('source').split('/').last"
}
mutate {
lowercase => ["filename"]
}
if "checked" not in [tags] {
grok {
remove_tag => ["_grokparsefailure"]
patterns_dir => ["/REDACTED/patterns.d"]
match => [
"message", '^"\s*%{OXFolge:folge}\s*%{OXFolge:folge2} \s*%{OXProg:programm}\s*%{OXBezeich:bezeichnung}\s*%{TIME:start_time:date}\s*%{TIME:end_time:date}\s*%{OXDuration:duration}\s*%{OXStatus:status}\s*"$'
]
add_tag => ["logline", "checked"]
}
if "_grokparsefailure" not in [tags] {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "ox-%{filename}-%{+YYYY.MM.dd}"
query => "tags:2headline"
fields => { "job_timestamp" => "_datestamp" }
}
ruby {
code => "
d = event.get('_datestamp')
t = event.get('start_time')
f = d+'-'+t
event.set('_timestamp', f)
"
}
date {
match => ["_timestamp", "dd.MM.yyyy-HH:mm:ss"]
target => "logstamp"
}
}
}
if "checked" not in [tags] {
grok {
remove_tag => ["_grokparsefailure"]
patterns_dir => ["/REDACTED/patterns.d"]
match => [
"message", '^"\s*%{WORD:dunno1}\s*%{NUMBER:dunno2}\s*%{GREEDYDATA:branch}\s*Abschlussinformationen / %{USERNAME:dunno3}\s*%{WORD:dunno4}\s*%{OXDuration:timestamp2}\s*%{WORD:dunno6}\s*%{OXDuration:timestamp3}\s*Seite\s*%{OXPage:page}\s*"$'
]
add_tag => ["headline", "checked"]
}
}
if "checked" not in [tags] {
grok {
remove_tag => ["_grokparsefailure"]
patterns_dir => ["/REDACTED/patterns.d"]
match => [
"message", '^"\s*Angefordert durch\s*:\s*%{OXRunUser:run_user}\s*Abschlussjob.*:\s*%{OXAbscJob:job_data}\s*%{DATE_EU:job_timestamp}\s*%{BASE10NUM:nr}\s*"$'
]
add_tag => ["2headline", "checked"]
}
}
}
output {
stdout {}
elasticsearch {
hosts => ["http://localhost:9200"]
index => "ox-%{filename}-%{+YYYY.MM.dd}"
}
}
```
And here is the stacktrace:
Sending Logstash logs to /REDACTED/Desktop/ which is now configured via log4j2.properties
[2018-11-25T05:38:03,137][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-11-25T05:38:03,155][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.5.0"}
[2018-11-25T05:38:08,968][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}
[2018-11-25T05:38:09,322][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://localhost:9200/](http://localhost:9200/)]}}
[2018-11-25T05:38:09,329][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"}
[2018-11-25T05:38:09,583][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://localhost:9200/](http://localhost:9200/)"}
[2018-11-25T05:38:09,633][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>6}
[2018-11-25T05:38:09,637][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6}
[2018-11-25T05:38:09,661][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[http://localhost:9200](http://localhost:9200)"]}
[2018-11-25T05:38:09,679][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}
[2018-11-25T05:38:09,702][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}
[2018-11-25T05:38:09,710][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}
[2018-11-25T05:38:09,839][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SyntaxError) (ruby filter code):3: syntax error, unexpected kEND
I am really out of ideas
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [November 26, 2018, 11:08am UTC](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081/2 "2018-11-26T11:08:58Z")
You're missing an _event.set_ closing parenthesis after _.last_ .This should work fine.
```auto
ruby {
code => "event.set('filename', event.get('source').split('/').last)"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2018, 11:09am UTC](https://discuss.elastic.co/t/error-with-ruby-filter-plugin/158081/3 "2018-12-24T11:09:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.