How to filter results based upon values using logstash ruby

I want filter the results based upon some column values of the index and perform math operation.
'tier0_cnt','tier1_cnt','tier2_cnt','tier0_amt','tier1_amt','tier2_amt' are the columns of my index.
I am using below logstash filter for that .

filter {
ruby {
code => "if [event.get('tier0_amt').to_i] > '9999'
event.set('tier1_cnt',event.get('tier1_cnt').to_i+event.get('tier0_cnt').to_i);
event.set('tier1_amt',event.get('tier0_amt').to_i+10000);
else
event.set('tier2_amt',event.get('tier0_amt').to_i+10000);
event.set('tier2_cnt',event.get('tier0_cnt').to_i*5;
end"
}
}

but while executing the logstash script ,I am getting errors:
04:57:23.184 [[main]>worker1] ERROR logstash.filters.ruby - Ruby exception occurred: undefined method `>' for [10000]:Array

how can we apply multiple filters in ruby like if else?

should be;

code => "if event.get('tier0_amt').to_i > 9999

Thanks it , worked :slight_smile:

Great. By way of explanation for future readers:

In the line [event.get('tier0_amt').to_i] > '9999' the LHS is a single element array containing the value from the 'tier0_amt' field, the RHS is a string constant. The operator > (greater_than) is applied as a method to the array with the string constant as the method parameter. The Ruby Array class does not have a > method. Hence the undefined method '>' for [10000]:Array error. So [10000].>('9999') gives the error but 10000.>('9999') returns true.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.