Help with Ruby code in Logstash

Elastic Stack Logstash
1

Hi, I have to create a new field in a Logstash filter which should be the result of a math operation between two other fields.

Given that I have defined in input section:

convert => { "field1" => "integer" }
convert => { "field2" => "integer" }

I want to create field3 = ( field1 - field2 ) / field1

I tried with this Ruby code:

ruby { code => 	"field3= ( event.get['field1'] - event.get['field2'] ) \ event.get['field1'];
				 event.set['field3'] = field3" }

But this ends up in a error:

[ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SyntaxError) (ruby filter code):2: syntax error, unexpected null

What is going wrong?

2

Try this

    ruby { 
        code => "
            field3 = ( event.get('field1').to_f - event.get('field2').to_f ) / event.get('field1').to_f;
            event.set('field3', field3)
        " 
    }
3

@Badger thank you.

I would like to introduce a check in order to avoid the situation in which field1 is equal to zero.
Do you think this is the correct approach?

if [field1] > 0 {
	ruby {
		code => "
			availability = ( event.get('field1').to_f - event.get('field2').to_f ) / event.get('field1').to_f;
			event.set('field3', field3)
			"
	}
}
4

That looks reasonable.

1 Like
5

Hi @Badger, sorry for resuming this topic but I'm facing a little issue with the code:

if [field1] > 0

This produces this error:

"exception"=>"comparison of String with 0 failed"

The thing is strange because in the filter I have defined field1 as integer:

convert => { "field1" => "integer" }

What am I missing?

6

I found the issue. This option here:

csv {
	skip_header => "true"

Is not working. So Logstash is importing the header of the CSV and this makes some fields containing strings. Is this a known bug?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.