Help parsing XML-filter processed data with ruby

Elastic Stack Logstash
1

Hi,

I need some help writing seemingly simple ruby code, but I can't figure out how (newbie).
At some point, my pipeline produces a field structured as follows::

   "xmldata" => {
"uplinkMessage" => {
    "constrainedData" => {
        "routeClearanceData" => {
            "RouteClearance" => {
                "routeInformations" => {
                    "publishedIdentifier" => [
                        [0] {
                            "fixName" => {
                                "name" => {
                                    "content" => "IRMAR"
                                }
                            }
                        },
                        [1] {
                            "fixName" => {
                                "name" => {
                                    "content" => "TAKES"
                                }
                            }
                        }
                    ]
                }
            }
        }
    }

I would like to reduce that collection of various fixName/name/content sub element values to a simple string: "IRMAR-TAKES-". But I can't get the ruby code right:

[2019-04-12T16:06:05,791][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method' for nil:NilClass`

Here is my code, thanks for any suggestion.

Olive

               ruby {
                code => '
                       route=""
                       rt=event.get("[xmldata][uplinkMessage][constrainedData][routeClearanceData][RouteClearance][routeInformations][publishedIdentifier]")
                       rt.each {|key,val|
                               route << val[key]["fixName"]["name"]["content"]
                               route <<"-"
                       }
                       event.set("Value",route)
                       '
        }
2

You do not really need a ruby filter for that.

mutate { add_field => { "Value" => "%{[xmldata][uplinkMessage][constrainedData][routeClearanceData][RouteClearance][routeInformations][publishedIdentifier][0][fixName][name][content]}-%{[xmldata][uplinkMessage][constrainedData][routeClearanceData][RouteClearance][routeInformations][publishedIdentifier][1][fixName][name][content]}" } }

would work. That said, how about

    ruby {
        code => '
           route=""
           rt=event.get("[xmldata][uplinkMessage][constrainedData][routeClearanceData][RouteClearance][routeInformations][publishedIdentifier]")
           rt.each_index { |x|
                   route << rt[x]["fixName"]["name"]["content"]
                   route <<"-"
           }
           event.set("Value",route)
           '
    }
3

Hi Badger,

The sequence of publishedIdentifier may contains more than 2 items, hence my insisting on iterating over that... collection ????

Thanks a lot for the help, I did not know that each_index (I totally s...tart with ruby).

Now it works except for the trailing '-' that I know how to fix.

Again, thanks a LOOOT!

Olivier

4

I would fix it using

event.set("Value",route.chomp("-"))
5

I did that too, thanks for the extra hint!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.