# How to use ruby variable outside ruby block?
**URL:** https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194
**Category:** Logstash
**Created:** [June 8, 2018, 8:11pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194 "2018-06-08T20:11:04Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)
#### Post date: [June 8, 2018, 8:11pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/1 "2018-06-08T20:11:05Z")
Hi,
I like to know, how to use ruby variable outside ruby code block.
say for eg.
input {
file {
path =\> "/logfile/\*"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
```
ruby {
code => "
log_pattern = event['fields'].split(',')
log_pattern.each_index { |i|
break if ['message'] == /log_pattern[i]/
event['index_value'] = log_pattern[i]
}
"
}
```
}
output {
elasticsearch {
hosts=\> [localhost:9200]
index =\> index\_value
}
stdout
{
codec=\>rubydebug
}
}
I want to use index value in output plugin as well as in filter plugin. how to do that?
Thanks,
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 12:39am UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/2 "2018-06-09T00:39:09Z")
It is not clear to me what you are trying to do, but if you want to set the value of a field on an event, you should use event.set, which is documented [here](https://www.elastic.co/guide/en/logstash/current/event-api.html).
I think in old versions you could do this
```
event['index_value'] = log_pattern[i]
```
but now you would would have to do
```
event.set('index_value', log_pattern[i])
```
And in your output, index =\> index\_value, as documented under sprintf format [here](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html), should be
```
index => "%{index_value}"
```
---
### Author:  [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)
#### Post date: [June 9, 2018, 10:06am UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/3 "2018-06-09T10:06:03Z")
Thanks for responding. But the index\_value is not applied in output plugin. In elasticsearch output, index =\> "%{index\_value}" the actual value is not applied in logstash output index tag.
input {
file {
path =\> "/digital/\*"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
}
}
filter {
```
ruby {
code => "
log_pattern = event['{{dvps.fields}}'].split(',')
log_pattern.each_index { |i|
break if ['message'] == /log_pattern[i]/
event.set('index_value', log_patter[i])
}
"
}
```
}
output {
elasticsearch {
hosts=\> ["localhost:9200"]
index =\> "%{index\_value}"
}
stdout
{
codec=\>rubydebug
}
}
Thanks.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 12:34pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/4 "2018-06-09T12:34:31Z")
What do you see in the rubydebug output for an event?
---
### Author:  [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)
#### Post date: [June 9, 2018, 2:09pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/5 "2018-06-09T14:09:45Z")
Ruby Exception.
"tags" =\> [
[0] "\_rubyexception"
]
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 2:47pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/6 "2018-06-09T14:47:32Z")
OK, so in your logstash logfile there should be an error message. Possibly something like "undefined variable or method 'log\_patter'". 😃
---
### Author:  [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)
#### Post date: [June 9, 2018, 2:49pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/7 "2018-06-09T14:49:27Z")
yep. you are right dude. But is there any possible to parse log files in ruby filter similar to kv filter?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/8 "2018-06-09T15:27:07Z")
What does your input line look like, and what do you want the output event to look like?
---
### Author:  [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)
#### Post date: [June 9, 2018, 7:01pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/9 "2018-06-09T19:01:18Z")
say for example this is my sample log,
2018-05-30 11:00:04,355 [INFO] packagename=sample.package.group, date=10-12-2017, status=pending,...etc.
I want to split this message with dynamic key value like packagename,data,status. and also the log format should not be same as all the files. so I have to split this logs with some respective keywords like how kv filter works. how to do that in ruby filter with dynamic key values.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 9:23pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/10 "2018-06-09T21:23:07Z")
I would use dissect (or grok) to take the date and log level off, then use a kv filter to parse the rest of the line. Why do you want to do it in ruby?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2018, 9:23pm UTC](https://discuss.elastic.co/t/how-to-use-ruby-variable-outside-ruby-block/135194/11 "2018-07-07T21:23:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.