# How to add a ruby code inside of the logstash config file?

**URL:** <https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965>\
**Category:** Logstash\
**Created:** [March 21, 2018, 10:51am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965 "2018-03-21T10:51:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yusuf\_Karatoprak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yusuf_karatoprak/32/44539_2.png) [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)\
**Post date:** [March 21, 2018, 10:51am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965/1 "2018-03-21T10:51:34Z")

</div>

I try to send logs to windows event by using logstash. After added some ruby code;it is created below error.How can I send logs to windows event?

input {  
file {  
type =\> "json"  
path =\> ["C:/Temp/logs/\*.json"]  
start\_position =\> "beginning"  
codec =\> "json"  
discover\_interval =\> 120  
stat\_interval =\> 60  
sincedb\_write\_interval =\> 60  
close\_older =\> 60  
}  
}  
filter {  
mutate {  
remove\_field =\> ["path"]

}  
ruby {  
code =\> "  
require 'win32/eventlog'  
logger = Win32::EventLog.new  
logger.report\_event(:event\_type =\> Win32::EventLog::INFO, :data =\> "a test event log entry")  
"  
}  
}  
}  
output {  
stdout {  
codec =\> rubydebug  
}

```
elasticsearch {
   hosts => ["http://loguser:xxxx@192.158.5.84:333"]
   index => "logstash-%{+YYYY.MM}"
}

```

}

Error:

```
[2018-03-20T09:51:28,629][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, {, } at line 23, column 75 (byte 464) after filter {\nmutate {\n remove_field => [\"path\"] \n\n}\n ruby {\n init => \" require 'win32/eventlog' \n\t \"\n code => \"\n logger = Win32::EventLog.new\n logger.report_event(:event_type => Win32::EventLog::INFO, :data => \""}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 21, 2018, 8:48pm UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965/2 "2018-03-21T20:48:52Z")

</div>

You can't have double quotes in your Ruby code if you're using double quotes as the delimiter for the code block. Replace `"a test event log entry"` with `'a test event log entry'`.

---

<div class="post-metadata">

**Author:** ![Yusuf\_Karatoprak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yusuf_karatoprak/32/44539_2.png) [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)\
**Post date:** [March 22, 2018, 11:20am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965/3 "2018-03-22T11:20:30Z")

</div>

Actually, I am trying to send logs to windows events. is it possible by using code what I wrote down.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 22, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965/4 "2018-03-22T11:24:03Z")

</div>

I don't know if the win32/eventlog gem will be available to you, but if it is I suppose it should work. But why ask me when you can try it out yourself?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-add-a-ruby-code-inside-of-the-logstash-config-file/124965/5 "2018-04-19T11:24:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.