# Execute program and assign a field its output through ruby filter

**URL:** <https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484>\
**Category:** Logstash\
**Created:** [March 28, 2020, 10:36am UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484 "2020-03-28T10:36:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![deostroll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deostroll/32/49539_2.png) [@deostroll](https://discuss.elastic.co/u/deostroll)\
**Post date:** [March 28, 2020, 10:36am UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/1 "2020-03-28T10:36:09Z")

</div>

My logstash receives JSON messages from a kafka topic. During development phase it is useful if I can read the json in a flattened way. There exists a program called **catj** which does this. It is an npm binary. You need to install it globally for it to work in the command line.

The usual way to run it is: `echo '<some_json_string>' | catj`

_ **Note:** _ I have to insert JSON between single-quotes (in the shell).

However, I get error when I set the filter like so:

```auto
filter {

  ruby {

    code => 'event.set("field", `echo 'event.get("message")' | catj`)'

  }

}

```

What is the correct way of writing code here?

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [March 28, 2020, 11:49am UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/2 "2020-03-28T11:49:19Z")

</div>

1. What error are you getting?

2. Can you give a sample incoming message and what would you expect it to look like after it has been processed please?

---

<div class="post-metadata">

**Author:** ![deostroll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deostroll/32/49539_2.png) [@deostroll](https://discuss.elastic.co/u/deostroll)\
**Post date:** [March 28, 2020, 3:30pm UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/3 "2020-03-28T15:30:08Z")

</div>

It goes something like this:

```auto
[2020-03-28T15:53:27,122][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"{\", \"}\" at line 13, column 38 (byte 219) after filter {\n\truby {\n\t\tcode => 'event.set(\"field\", `echo '", :backtrace=>["D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/compiler.rb:47:in `compile_imperative'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/compiler.rb:55:in `compile_graph'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/compiler.rb:17:in `block in compile_sources'", "org/jruby/RubyArray.java:2580:in `map'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/compiler.rb:14:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:161:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "D:/apps/elk/logstash-7.6.1/logstash-7.6.1/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 28, 2020, 5:31pm UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/4 "2020-03-28T17:31:50Z")

</div>

That's not how you fork a command in ruby. Read [this](https://www.rubyguides.com/2018/12/ruby-system/).

---

<div class="post-metadata">

**Author:** ![deostroll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deostroll/32/49539_2.png) [@deostroll](https://discuss.elastic.co/u/deostroll)\
**Post date:** [March 30, 2020, 2:46am UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/5 "2020-03-30T02:46:07Z")

</div>

Found it.

I realized we don't need the single-quotes.

```auto
filter {
	ruby {
		code => 'event.set("catj", `echo #{event.get("message")} | catj --no-color`)'
	}
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2020, 2:46am UTC](https://discuss.elastic.co/t/execute-program-and-assign-a-field-its-output-through-ruby-filter/225484/6 "2020-04-27T02:46:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.