# How to create ruby class variables mapped to a given ID? **URL:** \ **Category:** Logstash\ **Created:** [May 29, 2020, 9:03am UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887 "2020-05-29T09:03:49Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Nani\_20](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Post date:** [May 29, 2020, 9:03am UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/1 "2020-05-29T09:03:49Z")
Hi, I'm using below **Ruby filter** to find the elapsed time between a start and end event for a given user. The code works fine with the events coming in sequence. But, I have event logs coming from multiple users. I have used the file\_ID condition to avoid mismatch between users. But, I'm missing out on few events as the variable gets updated if multiple start events come together before the corresponding end events. **Ruby Filter** ```auto ruby { code => " if event.get('Event') == 'Start' @save_the_timestamp = event.get('@timestamp') @save_the_fileID = event.get('File_ID') elsif event.get('Event') == 'End' && event.get('File_ID') == @save_the_fileID event.set('reqtime', event.get('@timestamp') - @save_the_timestamp) end " } ``` Is there any way I can use a persistent Ruby variable for a given user and use it. Appreciate any help. Thanks in advance. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 29, 2020, 12:25pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/2 "2020-05-29T12:25:40Z")
Use an aggregate filter. ---
**Author:** ![Nani\_20](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Post date:** [May 29, 2020, 12:33pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/3 "2020-05-29T12:33:40Z")
I tried using that at the first place but I faced lot of issues as I have few other conditions as well apart from the one i mentioned above. Isn't there a solution in Ruby to have a **variable mapped to a specific ID** like we have **map** in aggregate? If so, that would be really helpful ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 29, 2020, 12:57pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/4 "2020-05-29T12:57:21Z")
> [@Nani\_20](#): > > Isn't there a solution in Ruby to have a **variable mapped to a specific ID** like we have **map** in aggregate? If so, that would be really helpful Sure, you can maintain a hash of hashes, where the outer hash is keyed by the ID, and the inner hash contains variables. That's what the map is in an aggregate filter. Just make sure you address the synchronization and threading issues that an aggregate filter addresses. ---
**Author:** ![Nani\_20](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Post date:** [June 4, 2020, 6:09pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/5 "2020-06-04T18:09:12Z")
Hi @Badger, Apologies for the delay, I have a quick followup question on the above solution. I tried the below ruby filter for creating a **hash keyed** to an **File\_ID** field. **Ruby Filter** ``` ruby { init => "@save_the_timestamp = Hash.new" code => " if event.get('Event') == 'Start' save_the_fileID = event.get('File_ID') @save_the_timestamp[save_the_fileID] = event.get('@timestamp') elsif event.get('Event') == 'End' if @save_the_timestamp[event.get('File_ID')] event.set('reqtime', event.get('@timestamp') - @save_the_timestamp[save_the_fileID]) @save_the_timestamp.delete(event.get('File_ID')) end end " } ``` But, I am receiving the below error `[2020-06-04T23:28:46,051][ERROR][logstash.filters.ruby][main] Ruby exception occurred: can't convert nil into an exact number` Could you please have a look and let me know whats going wrong here? TIA ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 4, 2020, 6:15pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/6 "2020-06-04T18:15:16Z")
Is it possible an End arrived before a Start? Have you set pipeline.workers 1? Have you disabled java\_execution? ---
**Author:** ![Nani\_20](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Post date:** [June 4, 2020, 6:21pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/7 "2020-06-04T18:21:08Z")
No, for a given File\_ID, End always appears after the corresponding Start event. Also, in the `End condition` I am anyways checking for the existence of the hash before performing any action. And Yes, I have done both. Disabled Java\_execution & have set pipeline.workers to 1 ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 4, 2020, 6:34pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/8 "2020-06-04T18:34:32Z")
> [@Nani\_20](#): > > `- @save_the_timestamp[save_the_fileID]` You do not appear to have set save\_the\_fileID ---
**Author:** ![Nani\_20](https://avatars.discourse-cdn.com/v4/letter/n/4491bb/32.png) [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Post date:** [June 4, 2020, 6:58pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/9 "2020-06-04T18:58:02Z")
Yes, I haven't set that. It's working fine now. Thanks a lot. I believe this should now work with any number of hashes right? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 4, 2020, 7:26pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/10 "2020-06-04T19:26:52Z")
> [@Nani\_20](#): > > I believe this should now work with any number of hashes right? I believe so. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 2, 2020, 7:38pm UTC](https://discuss.elastic.co/t/how-to-create-ruby-class-variables-mapped-to-a-given-id/234887/11 "2020-07-02T19:38:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.