From scripted field to logstash

I dunno if this is the place, but since the destination is Logstash's ruby filter, I think it is.
I have this massive scripted field... and I'm considering reindexing and adding it to the pipeline config, but I'm not really sure how to change painless into ruby. Maybe you guys have some pointers?

It's a scripted field to ease up my team's life when digging into RRAS logs, so it takes a couple fields and gives back a single "ConnectionInfo", containing stuff like parse from Packet Type, Account Status Type, Reason Code and Account Session Time.

I'm not looking for someone to just "translate" it to me, of course, but a couple tips I think would be faster than me trying to learn Ruby all over just for this field.

It starts like this... scripted field is called "ConnectionInfo".

def code = doc['ReasonCode.keyword'].value;
def packet = doc['PacketType.keyword'].value;
def type = doc['AcctStatusType.keyword'].value;
def tempo = doc['AcctSessionTime.keyword'].value;
def sessionTime = "";

if (tempo != null) { 
	def time = Integer.parseInt(tempo);
	if (time == 0) { sessionTime = "Nao disponivel" }
	else if (time > 3600) { sessionTime = (time / 60 / 60) + " horas, " + (time / 60 % 60) + " minutos e " + (time % 60) + " segundos" }
	else if (time > 60) { sessionTime = (time / 60 % 60) + " minutos e " + (time % 60) + " segundos" }
	else { sessionTime = time + " segundos" }
} else { sessionTime = ""}

if (code == "0") { 
	if ( packet == "1") { return "CONNECTION_REQUEST"; }
	else { 
		if (type == "1") {return "START_CONNECTION"}
		else if (type == "2") {return "END_CONNECTION : " + sessionTime}
		else { return "SUCCESS"; }
		}
	} else if (code == "1") { return "REFUSED: INTERNAL_ERROR";
} else { return code; }

I understand it may end up too big for using inline ruby code, so I'd have to move over to using a Ruby script file.

Scratch all that, got it.

code = event.get("ReasonCode").to_i;
packet = event.get("PacketType").to_i;
type = event.get("AcctStatusType").to_i;
tempo = event.get("AcctSessionTime").to_i;

if ! tempo.nil?
  time = tempo;
  if time == 0
    sessionTime = "Nao disponivel";
  elsif time > 3600
    sessionTime = (time / 60 / 60).to_s + " horas, " + (time / 60 % 60).to_s + " minutos e " + (time % 60).to_s + " segundos";
  elsif time > 60
    sessionTime = (time / 60 % 60).to_s + " minutos e " + (time % 60).to_s + " segundos";
  else
    sessionTime = time.to_s + " segundos";
  end
end

if code == 0
  if packet == 1
    connectionInfo = "CONNECTION_REQUEST";
  else
    if type == 1
      connectionInfo = "START_CONNECTION";
    elsif type == 2
      connectionInfo = "END_CONNECTION : " + sessionTime;
    else
      connectionInfo = "SUCCESS";
    end
  end
elsif code == 1
  connectionInfo = "REFUSED: INTERNAL_ERROR";
else
  connectionInfo = code;
end

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.