How to send grok field into ruby

Elastic Stack Logstash
1

filter{
grok{
match =>{"message" => "%{GREEDYDATA:selectedMessage}"}
}
Ruby{
path ="test.rb"
script_params => {

   "percentage" => selectedMessage }

}
}

how can send any example!

2

What does your data look like? What are you trying to achieve? Showing an example is often much better than trying to describe the problem?

3

how can i access grok filter "%{GREADYDATA:selectedMessage}" in Ruby filter script_params ?

4

This doesn't really make much sense as it will just copy the message field into a selectedMessage field. Please explain what you are trying to do with your data, not how.

Why do you need to use a ruby filter? What do you want to do with it?

5

hi christian_Dahlqvist,
my log data is different patterns
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:Date} %{TIMESTAMP_ISO8601:Actual_Date} (?[\w.|-]+) <%{LOGLEVEL:Severity}> (?[\w:|_]+): %{GREEDYDATA:Detalis}"}

}
Above filter i used after "%{GREEDYDATA:Detalis}" this data is i need to send ruby filter and run regux operation.
i used ruby path and script_params to perform .
how can i do this ?

6

You should be able to get to all fields of the event through the event that is passed to the filter method. I would expect the filter to be initialised based on the script_params once and not per event.

7

Error:-
Could not process event: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

8

That error message explains it quite well.

9

Thanks i got it

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.