How can I create new events in ruby filter?

Elastic Stack Logstash
1

I want to create new events from the existing one. I'd rather not create, compile and install a new filter if possible rather I'd like to use a ruby filter, e.g.

filter{
    ruby{
        code => '
            host_list = event["hostList"]
            # create new event for each host
            host_list.each do |host|
                new_event = event.clone
                # add/remove stuff from new_event
                yield new_event #FAILS! yield called out of block
            end
        '
    }
}

I understand why the yield fails but I don't know how to make the new event show up in rubydebug codec. Any help appreciated.

Craig

1 Like
2

Just saw this: configuration - Logstash dynamically split events - Stack Overflow

You need to resort to a custom filter for this (you can't call yield from a ruby code filter which is what's needed to generate new events).

1 Like