Event.set does not work

Hello, I'm trying to create new field in my filter, but seems that event.set does not work properly. I can't see neither errors nor the new fields in elastic.

I had to add the if condition since the field is not contained in all the document. How can I add the new derived field?

ruby {
        init => "require 'time'"
        code => "
                 duration = (event.get('@timestamp').to_i - event.get('start_date').to_i)/60/60;
                 event.set('system.process.cpu.duration', duration);
                 if event.get('system.filesystem.free') != nil
                        fs_gb = event.get('system.filesystem.free') / (1024*1024*1024);
                        event.set('system.filesystem.free_gb', fs_gb);
                 if event.get('system.cpu.total.pct') != nil
                        cpu_pct = event.get('system.cpu.total.pct') * 100;
                        event.set('system.cpu.total.pct_100', cpu_pct);
                 if !event.get('system.cpu.total.pct').nil?; event.set('cpu_pct',event.get('system.cpu.total.pct') * 100);end

Consider that only system.process.cpu.duration is set properly

If that is coming from metricbeat you would have to use

 if event.get('[system][filesystem][free]')

and so on. logstash does not use the naming convention for fields inside objects that beats and Elasticsearch use.

I'm making the same exercise for an aws rds metric, but it is not work. Here is the configuration. Are this module has a different syntax?

 if event.get('[aws][rds][free_storage][bytes]') != nil
                                rds_free_gb = event.get('[aws][rds][free_storage][bytes]') / (1024*1024*1024);
                                event.set('[aws][rds][free_storage][gb]', rds_free_gb);

Enyone faced the same issue with this metricbeat module? How could I read the incoming events to check the syntax?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.