How to pass variable from Logstash filter into ruby parameter

[Jirka_Liska (Jirka Liška)]

Hi

I'm trying to create a variable which holds information from input file path. I'm able to do so for example for creating index in Kibana but I'm unable to pass this variable into ruby /plugin/ code. Anyone knows what I'm doing wrong here?

Thanks in advance

here I'm creating variable PK from file path

    grok {
      match => {
        "[log][file][path]" => ["(?:%{BASE10NUM:PK}-)"]
      }
    }

Here I'm trying to pass it into ruby as parameter

      ruby {
        path => "/usr/local/supporting-scripts/webhook.rb"
        script_params => {
        "primary_key" => "PK"
        }
      }

I have tried different possibilities like

"[PK]"; "%{[PK]}"; "[PK]"; 

nothing worked

[Ofir_Edi]

Hi,
From what I can see you are extracting PK from the original event and after the grok filter it should be a field on your event.

Since it is part of your event you can access it via the filter function in the ruby code and you don't need to pass it as script_param. the following script addes a new field with the Dynamic value of PK:

# the value of `params` is the value of the hash passed to `script_params`
# in the logstash configuration

def register(params)

end

# the filter method receives an event and must return a list of events.
# Dropping an event means not including it in the return array,
# while creating new ones only requires you to add a new instance of
# LogStash::Event to the returned array

def filter(event)

event.set("testField", event.get("[PK]"));

return [event]

end

Hopes this is helpful.

[Jirka_Liska (Jirka Liška)]

Thanks for your reply, it make sense but when I use it like this I'm getting this error:

Could not process event: undefined local variable or method `testField' for

def filter(event)
    event.set("testField", event.get("[PK]"));

    url = URI('http://rest_api:8000/api/' + testField.to_s + "/")
   
   return []

end

[Ofir_Edi]

Hi @Jirka_Liska ,
you need to use the event.get api to access the variable or to first get it and then use it as a variable.
also, you must return the event (returning an empty array is like drop). In addition, you need to import uri module.

Kindly try the following (I have ommited to_s as PK is probably already a string)

require 'uri';
def filter(event)
    primary_key =  event.get("[PK]");

    url = URI('http://rest_api:8000/api/' + primary_key + "/")
   
   return [event]

end

Also please notice that you are not manipulating the event in the filter (you init url variable but not using it).

Ofir

[Jirka_Liska (Jirka Liška)]

Hi @Ofir_Edi, thanks a lot for your kind support! This solved my problem, thank you