Help with the logstash ruby filter.Ruby exception occurred: undefined method `time' for 1546441403:Fixnum


filter {
    if [is_try] == 1 {
         drop { }
    } 

    ruby { 
         code => "

            fmt = '%Y-%m-%dT%H:%M:%S.%L%z'
            tz = '+08:00'

            create_time = event.get('[create_time]').time
            update_time = event.get('[update_time]').time

            event.set('create_time', create_time.localtime(tz).strftime(fmt))
            event.set('update_time', update_time.localtime(tz).strftime(fmt))


            event.set('yearandmonth', event.get('[create_time]').to_time.localtime(tz).strftime('%Y%m'))


            all_money = event.get('cash') + event.get('points') 
            event.set('all_money', all_money)

                 "
    } 
}

The above code will end up with

[2019-01-02T23:06:00,402][ERROR][logstash.filters.ruby    ] Ruby exception occurred: undefined method `time' for 1546441403:Fixnum

Struggled for hours,please help.

  1. why this exception occurs?
  2. the variable yearandmonth will not work ,instead it results a index name like this _dev_%{yearandmonth}

Somehow I figured out how to make it right.
It really made me hair lose,lucky for you.

filter {
    if [is_try] == 1 {
         drop { }
    } 

    ruby { 
         code => "
                  require 'time'
                  require 'date'

                  fmt = '%Y-%m-%dT%H:%M:%S.%L%z'
                  tz = '+08:00'

                  create_time = event.get('[create_time]')
                  update_time = event.get('[update_time]')

                  event.set('create_time', Time.at(create_time).localtime(tz).strftime(fmt))
                  event.set('update_time', Time.at(update_time).localtime(tz).strftime(fmt))

                  event.set('yearandmonth', Time.at(create_time).localtime(tz).strftime('%Y%m'))

                  all_money = event.get('cash') + event.get('points')
                  event.set('all_money', all_money)
                 "
    } 
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.