Getting error SyntaxError: (ruby filter code):3: syntax error, unexpected kIN logstash

Elastic Stack Logstash
1

I want to split string field "label" which contains hyphen e.g. "Label =SCR1-xyz_abc-Page "
I am trying to split

Scenario= SCR1
Transaction =xyz_abc
Request=Page

But with below config getting syntax error. Any idea why?

filter{

csv {
separator => ","
columns => ["timeStamp", "elapsed", "label"]
}

ruby {
code => "
tmp = event['label']
in = tmp.split('-')
puts tmp
event['Scenario'] = in[0]
event['Transaction'] = in[1]
event['Request'] = in[3]
"
}
}

2

I can't spot any errors in that piece of Ruby, but why not just use the mutate filter's split option?

3

As per my understanding if I use below option it will split the strings in same field 'Label'.
mutate {
split => { "label" => "-" }
}

Currently I have three columns:
Header: Label|ResponseCode|URL
Value: Thread-group1-transaction_1|200|Null
Value: Thread-group1-transaction_1-Request1|200|http://google.co.in
Value: Thread-group1-transaction_1-Request2|200|http://google.co.in/image
Value: Thread-group1-transaction_1-Request3|300|http://google.co.in
and so...
However my requirement is to store "Thread-group1-transaction_1-Request" in such a way that when I search for Request; get corresponding column value of URL, when search for transaction get their corresponding value i.e.Null.

I believe storing each segment in separate field will help in searching. Is it posssible to split and store in separate fields.

4

The mutate filter's split option can only split into the same field, but there are other options for the mutate filter that can help you create new fields based on each array item in an array field.

5

I got success using below config and achieved what I wanted too...

mutate {
split => { "label" => "-" }
add_field => { "Scenario" => "%{[label][0]}" }
add_field => { "Transaction" => "%{[label][1]}" }
add_field => { "Request" => "%{[label][2]}" }
}

thanks!