Hi.
I have this config:
input {
file {
path => "/opt/logs/sb_log.json"
sincedb_path => "/etc/logstash/.sincedb_sblog"
start_position => "beginning"
}
}
filter{
json {
source => "message"
}
json {
source => "payload"
target => "parsepaylaod"
}
json {
source => "headers"
target => "parseheaders"
}
mutate {
convert => ["parentId","integer"]
convert => ["currentNano","integer"]
convert => ["createTimeMillis","integer"]
convert => ["elapse","float"]
}
ruby {
code => "event.set('diff',(event.get(['_source']['parseheaders']['kafka_receivedTimestamp']) - event.get('createTimeMillis')))"
}
mutate {
remove_field => ["@version" ]
}
if "_jsonparsefailure" in [tags] { drop {} }
}
output {
elasticsearch {
hosts => ["http://192.168.0.39:9200"]
user => "user"
password => "pass"
index => "logstash_index_beta"
}
}
I have two questions, my syntax in ruby is correct? Do I cat get parseheaders.kafka_receivedTimestamp
value this way?
code => "event.set('diff',(event.get(['_source']['parseheaders']['kafka_receivedTimestamp']) - event.get('createTimeMillis')))"
another this parseheaders.kafka_receivedTimestamp
and createTimeMillis
is integer type but I get this error
Sep 23 20:22:18 app1 logstash[31508]: [2020-09-23T20:22:18,571][ERROR][logstash.filters.ruby ][main][c86aa057dfd82fb3bc82c6597913f6166b84156506f117224d0d3540263942d5] Ruby exception occurred: no implicit conversion of String into Integer
Sep 23 20:22:18 app1 logstash[31508]: [2020-09-23T20:22:18,573][ERROR][logstash.filters.ruby ][main][c86aa057dfd82fb3bc82c6597913f6166b84156506f117224d0d3540263942d5] Ruby exception occurred: no implicit conversion of String into Integer
Sep 23 20:22:18 app1 logstash[31508]: [2020-09-23T20:22:18,574][ERROR][logstash.filters.ruby ][main][c86aa057dfd82fb3bc82c6597913f6166b84156506f117224d0d3540263942d5] Ruby exception occurred: no implicit conversion of String into Integer
thanks a lot for your help.