How to pass mutate filter field value to Ruby filter

[saroja (sks)]

input {
  http_poller {
          urls => {
               request1 => {
                   method => get
                   url => "http://localhost:8888/getAuthToken?uid=${uid}&password=${password}"
		
				   headers => {
                            Accept => "application/json"
                   } 
				  
	
                }
				    `indent preformatted text by 4 spaces`
            }
		#response string would be like below
		#{"token_type":"mybearer","mapi":"API Key","access_token":"wxyzppppqqqrrrsss","scope":"scope","refresh_token":"9999911222","@timestamp":"2019-05-09T10:07:01.265Z","expires_in":3600,"@version":"1"}
		
		request_timeout => 60
        #Supports "cron", "every", "at" and "in" schedules by rufus scheduler
        schedule => { cron => "*/1 * * * * UTC"}
		
        codec => "json"
		
        # A hash of request metadata info (timing, response headers, etc.) will be sent here
        #metadata_target => "http_poller_metadata"
		
		target => "response_message"
	}
		                  

}	

filter {

  grok {
      match => { "message" => "%{GREEDYDATA:response_message}"}
     }
	 
	mutate { 
    	add_field => { 
		"token_type" => "%{[response_message][token_type]}"  
		"access_token" => "%{[response_message][access_token]}" 
		"refresh_token" => "%{[response_message][refresh_token]}" 
		} 
		remove_field => [ "response_message"]
    }
	mutate { 
    	add_field => { 
		 "[@metadata][token_type]" => "%{token_type}" 
		 "[@metadata][access_token]" => "%{access_token}" 
		} 
    }
	
 ruby {
        
	    code => "event.set( 'param1',%{[token_type]})"
	}
 ruby {
   
	   code => "event.set( 'param2',%{[access_token]})"
	}

  ruby {
    init => "
	        require 'net/http';
	        require 'json'"
    code => "   
		 event.set('param3',event.get('param1'));
		 event.set('param4',event.get('param2'));
		 uri = URI('http://127.0.0.1:8888/getDetails?tokentype=%{param3}&accesstoken=%{param4}')
         res = Net::HTTP.get_response(uri);
		 result = JSON.parse(res.body)
		 event.set('resmsg',result);
		 "
  }
  
  
  
  
}

output {
  stdout {
    codec => rubydebug 
  }
  
}

Not able to set the field value in ruby filter and getting output like bellow. Could you please help me out to resolve it. Thanks.

{
           "param1" => "[token_type]",
           "param3" => "[token_type]",
       
           "param4" => "[access_token]",
           "param2" => "[access_token]",
    }

[yaauie (Ry Biesemeyer)]

the code strings being passed to the ruby filter do not support sprintf string interpolation, because the code is transformed into a helper at filter startup that is shared across events.

You'll need to use the Event API's Event#get(fieldname) inside the code to get a value from the current event:

filter {
  ruby {
    code => "
      token_type = event.get('[token_type]')
      event.set('[param1]', token_type) unless token_type.nil?
    "
  }
}

[Badger]

@saroja

ruby { code => "event.set( 'param1',%{[token_type]})" }

Why do this with ruby rather than mutate+copy or mutate+add_field?

code => "   
	 event.set('param3',event.get('param1'));
	 event.set('param4',event.get('param2'));
	 uri = URI('http://127.0.0.1:8888/getDetails?tokentype=%{param3}&accesstoken=%{param4}')
     [...]
	 "

You can do that using

    ruby {
        code => '
     p1 = event.get("param1")
     p2 = event.get("param2")
     uri = URI("http://127.0.0.1:8888/getDetails?tokentype=#{p1}&accesstoken=#{p2}")

Why not use an http filter plugin?

[saroja (sks)]

Hi Badger,

Thank you very much for your prompt response.I have used the mutate+copy with ruby filter.Now code is working properly. I am adding code here.

{
input{
#input wll geneate the json string.
#{"token_type":"mybearer","mapi":"API Key","access_token":"wxyzppppqqqrrrsss","scope":"scope","refresh_token":"9999911222","@timestamp":"2019-05-09T10:07:01.265Z","expires_in":3600,"@version":"1"}
}
}

filter {
mutate {
add_field => {
"token_type" => "%{[response_message][token_type]}"
"access_token" => "%{[response_message][access_token]}"
"refresh_token" => "%{[response_message][refresh_token]}"
}
remove_field => [ "response_message"]
}

mutate {
copy => {
"token_type" => "param1"
"access_token" => "param2"
}
}

ruby {
init => "
require 'net/http';
require 'json'"
code => "
p1 = event.get('param1');
p2 = event.get('param2');
uri = URI('http://localhost:8888/getDetails?tokentype=p1&accesstoken=p2')
res = Net::HTTP.get_response(uri);
#result = JSON.parse(res.body);
event.set('resmsg',res.code);
"
}

}
output {
stdout {
codec => rubydebug

}
}

Thank you