# Input and output "message" field in Ruby filter

**URL:** <https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886>\
**Category:** Logstash\
**Created:** [April 27, 2020, 2:45am UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886 "2020-04-27T02:45:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikwp](https://avatars.discourse-cdn.com/v4/letter/e/97f17d/32.png) [@erikwp](https://discuss.elastic.co/u/erikwp)\
**Post date:** [April 27, 2020, 2:45am UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886/1 "2020-04-27T02:45:33Z")

</div>

I am having difficulties with the Ruby filter. As I understand it, "message" is the default field that contains your input. What I want to do is take my input and filter the whole message string into my Ruby filter (which in my case is calling and providing input to a javascript file).

What is not at all clear to me is how to simply get the entire input message in Ruby. How do I get the "message" field into Ruby and how do I get it out at the end? Again, I want to process the entire string from my input, not just a specific field. Any help is much appreciated.

```auto
    input {
      file {
        path => "/Users/xxxxx/Documents/xxxxx/example.log"
        }
    }
    filter{
ruby {
  code => '
          require "open3"
          inputString = "message"
          cmd = "node Users/xxxx/Documents/xxxx/exampleJS/test.js #{inputString}"
          stdin, stdout, stderr = Open3.popen3(cmd)
          event.set("message", stdout.read)
          err = stderr.read
          if err.to_s.empty?
            filter_matched(event)
          else
            event.set("message", err)
          end'
  }
  json {
     source => "message"
  }
}

```

By the way I based the above code on [this post](http://vrepin.org/vr/Logstash-filter-external-script/).

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 27, 2020, 2:04pm UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886/2 "2020-04-27T14:04:53Z")

</div>

In a ruby filter you can use event.get("message") to access the whole [message] field.

---

<div class="post-metadata">

**Author:** ![erikwp](https://avatars.discourse-cdn.com/v4/letter/e/97f17d/32.png) [@erikwp](https://discuss.elastic.co/u/erikwp)\
**Post date:** [April 27, 2020, 6:21pm UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886/3 "2020-04-27T18:21:20Z")

</div>

Thank you I got it working. For reference here is my working solution, it takes in a stringified json file, does a transformation in javascript and outputs as json file:

```auto
filter{
      ruby {
        code => '
          require "open3"
          jsonString = event.get("message")
          cmd = "node /Users/xxx/Documents/xxx/exampleJS/test.js #{jsonString}"
          stdin, stdout, stderr = Open3.popen3(cmd)
          event.set("message", stdout.read)
          err = stderr.read
          if err.to_s.empty?
            filter_matched(event)
          else
            event.set("message", err)
          end'
  }
  json {
     source => "message"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2020, 6:21pm UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886/4 "2020-05-25T18:21:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.