How to send grok field into ruby

filter{
grok{
match =>{"message" => "%{GREEDYDATA:selectedMessage}"}
}
Ruby{
path ="test.rb"
script_params => {

   "percentage" => selectedMessage }

}
}

how can send any example!

What does your data look like? What are you trying to achieve? Showing an example is often much better than trying to describe the problem?

how can i access grok filter "%{GREADYDATA:selectedMessage}" in Ruby filter script_params ?

This doesn't really make much sense as it will just copy the message field into a selectedMessage field. Please explain what you are trying to do with your data, not how.

Why do you need to use a ruby filter? What do you want to do with it?

hi christian_Dahlqvist,
my log data is different patterns
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:Date} %{TIMESTAMP_ISO8601:Actual_Date} (?[\w.|-]+) <%{LOGLEVEL:Severity}> (?[\w:|_]+): %{GREEDYDATA:Detalis}"}

}
Above filter i used after "%{GREEDYDATA:Detalis}" this data is i need to send ruby filter and run regux operation.
i used ruby path and script_params to perform .
how can i do this ?

You should be able to get to all fields of the event through the event that is passed to the filter method. I would expect the filter to be initialised based on the script_params once and not per event.

Error:-
Could not process event: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

That error message explains it quite well.

Thanks i got it

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.