How to send grok field into ruby

(veer) #1

match =>{"message" => "%{GREEDYDATA:selectedMessage}"}
path ="test.rb"
script_params => {

   "percentage" => selectedMessage }


how can send any example!

(Christian Dahlqvist) #2

What does your data look like? What are you trying to achieve? Showing an example is often much better than trying to describe the problem?

(veer) #3

how can i access grok filter "%{GREADYDATA:selectedMessage}" in Ruby filter script_params ?

(Christian Dahlqvist) #4

This doesn't really make much sense as it will just copy the message field into a selectedMessage field. Please explain what you are trying to do with your data, not how.

Why do you need to use a ruby filter? What do you want to do with it?

(veer) #5

hi christian_Dahlqvist,
my log data is different patterns
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:Date} %{TIMESTAMP_ISO8601:Actual_Date} (?[\w.|-]+) <%{LOGLEVEL:Severity}> (?[\w:|_]+): %{GREEDYDATA:Detalis}"}

Above filter i used after "%{GREEDYDATA:Detalis}" this data is i need to send ruby filter and run regux operation.
i used ruby path and script_params to perform .
how can i do this ?

(Christian Dahlqvist) #6

You should be able to get to all fields of the event through the event that is passed to the filter method. I would expect the filter to be initialised based on the script_params once and not per event.

(veer) #7

Could not process event: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

(Christian Dahlqvist) #8

That error message explains it quite well.

(veer) #9

Thanks i got it

(system) #10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.