# Help with RUBY. Recognising field with prefix and changing its type

**URL:** https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157
**Category:** Logstash
**Created:** [October 12, 2018, 4:58am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157 "2018-10-12T04:58:13Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 12, 2018, 4:58am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/1 "2018-10-12T04:58:13Z")

</div>

Hi, I am trying to convert fields with a certain prefix into an integer

```
      event.to_hash.keys.each { |k|
    if event.get[k].is_a?(String) and k.start_with?('behaviour_' || 'top_disease_')
      event.get[k] = event.set[k].to_i
    end
  }

```

Ideally I want to check prefix (for behaviour or top\_disease) and then whether its a string.

I also found another post about this code structure; but it does not work either

```
    code => "event.set(k, v.to_f) if k.start_with?('behaviour_' || 'top_disease_')"

```

I have modified the RUBY code as under:

```
  ruby {
code => "
  event.to_hash.keys.each { |k|
    if event.get[k].start_with?('behaviour_' || 'top_disease_') and k.is_a?(String)
      event.get[k] = event.set[k].to_i
    end
  }
"}

```

By doing this, I am getting the following error:

> Ruby exception occurred: wrong number of arguments calling 'get' \<0 for 1\>

Another try:

```
  ruby {
code => "
  event.to_hash.keys.each { |k|
    if event[k].start_with?('behaviour_' || 'top_disease_') and k.is_a?(String)
      event.set[k].to_i
    end
  }
"
}

```

---

<div class="post-metadata">

### Author: ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)
#### Post date: [October 12, 2018, 10:02am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/2 "2018-10-12T10:02:59Z")

</div>

I think your issue may come from the use of event.get/set functions :

```
ruby {
  code => "
    event.to_hash.keys.each { |k|
      if event.get(k).start_with?('behaviour_' || 'top_disease_') and k.is_a?(String)
        event.get(k) = event.set(k, k.to_i)
      end
    }
  "
}
```

---

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 12, 2018, 10:04am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/3 "2018-10-12T10:04:57Z")

</div>

There are over 50 fields... I have tried the mutate filter to convert them into integer. With the filter, it works. Further, these fields are created dynamically -- so the additions can be on-the-fly taking them to more than 50 in the near future. Is there any documentation about using the ruby plugin? The ruby-filter plugin guidelines are not very clear. I am unable to understand the get/set stuff.

There is another similar query but it is unresolved.

> [@Can't convert types using mutate or ruby filter from fields generated with kv](https://discuss.elastic.co/t/cant-convert-types-using-mutate-or-ruby-filter-from-fields-generated-with-kv/91339):
>
> I have many fields generated from the kv plugin like so: kv { source =\> "kvpairs" remove\_field =\> ["kvpairs"] } I have tried both of the following and neither result in the fields being converted to their proper types. #iterate through each key and attribute types via convetion ruby { code =\> " event.to\_hash.each { |k, v| event[k] = v.to\_f if k.end\_with? '\_f' event[k] = v.to\_i if k.end\_with? '\_i' } " } After this failed, the new f…

---

<div class="post-metadata">

### Author: ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)
#### Post date: [October 12, 2018, 10:08am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/4 "2018-10-12T10:08:07Z")

</div>

Yes I figured, this is why I have edited my answer and put my question back 😋

Have you tried my solution ?

---

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 12, 2018, 10:16am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/5 "2018-10-12T10:16:39Z")

</div>

I tried it but it gives an unexpected "=" error in  
`event.get(k) = event.set(k, k.to_i)`

---

<div class="post-metadata">

### Author: ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)
#### Post date: [October 12, 2018, 12:17pm UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/7 "2018-10-12T12:17:43Z")

</div>

my bad, try this :

```
ruby {
  code => "
    event.to_hash.keys.each { |k|
      if event.get(k).start_with?('behaviour_' || 'top_disease_')
        event.set(k, event.get(k).to_i)
      end
    }
  "
}
```

---

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 12, 2018, 2:50pm UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/8 "2018-10-12T14:50:38Z")

</div>

I think now we are getting somwhere.. I got the following error:

> Ruby exception occurred: undefined method `start\_with?' for nil:NilClass

I tried removed || with a , but it did not work and I got the same error.

> ruby {  
> code =\> "  
> event.to\_hash.keys.each { |k|  
> if event.get(k).start\_with?('behaviour\_' , 'top\_disease\_')  
> event.set(k, event.get(k).to\_i)  
> end  
> }  
> "  
> }

---

<div class="post-metadata">

### Author: ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)
#### Post date: [October 12, 2018, 3:19pm UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/9 "2018-10-12T15:19:51Z")

</div>

try this :

```
ruby {
  code => "
    event.to_hash.keys.each { |k|
      if ( event.get(k).start_with?('behaviour_') || event.get(k).start_with?('top_disease_') )
        event.set(k, event.get(k).to_i)
      end
    }
  "
}

```

or

```
ruby {
  code => "
    event.to_hash.keys.each { |k|
      event.get(k).match('(behaviour|top_disease)_.*') {
        event.set(k, event.get(k).to_i)
      }
    }
  "
}
```

---

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 13, 2018, 1:41am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/10 "2018-10-13T01:41:31Z")

</div>

Still the undefined error for both start\_with and match

---

<div class="post-metadata">

### Author: ![Harshet\_Jain](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)
#### Post date: [October 13, 2018, 12:47pm UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/11 "2018-10-13T12:47:59Z")

</div>

any other ideas?

---

<div class="post-metadata">

### Author: ![OphyTe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ophyte/32/36444_2.png) [@OphyTe](https://discuss.elastic.co/u/OphyTe)
#### Post date: [October 15, 2018, 8:28am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/12 "2018-10-15T08:28:38Z")

</div>

Hi Jainh, could you give us a sample event ?

Because the error let me think that your fields '_behaviour__\_' or 'top\_disease_\_' are empty ... cf. [Event API | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-api.html)

> **Get API**
> 
> The getter is a read-only access of field-based data in an Event.
> 
> **Syntax:** `event.get(field)`
> 
> **Returns:** Value for this field or nil if the field does not exist. Returned values could be a string, numeric or timestamp scalar value.

Remove your filter and print the output with

```
output {
  stdout {}
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 12, 2018, 8:38am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157/13 "2018-11-12T08:38:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
