Issue changing value of JSON field in logstash

Elastic Stack Logstash
1

Hi,

I'm trying to change a value in logstash of JSON which has been generated by Topbeat

Below are the input file name, the logstash filter, and the error that I am getting

Can anyone spot why I'm getting the error please ?

Very Much appreciated,
Mick

JSON input file

{
"_index": "logstashsystem-2016.06.08",
"_type": "system",
"_id": "AVUxwZ29nE6fvOfjobS-",
"_score": null,
"_source": {
"@timestamp": "2016-06-08T20:43:39.209Z",
"beat": {
"hostname": "serverName",
"name": "serverName"
},
"cpu": {
"idle": 359180971,
"iowait": 211944,
"irq": 91,
"nice": 54369,
"softirq": 33274,
"steal": 0,
"system": 2280639,
"system_p": 0.0045,
"user": 4354223,
"user_p": 0.011
},
"sort": [
1465418619209
]
}

Logstash Filter

filter{
ruby {
code => "event['_source']['cpu']['system_p'] = event['_source']['cpu']['system_p'].to_f * 100"
}
}

Error

{:timestamp=>"2016-06-09T09:29:08.352000+0000", :message=>"Ruby exception occurred: undefined method `[]' for nil:NilClass", :level=>:error}

2

What do the events that Logstash is processing look like? Please show the output of a stdout { codec => rubydebug } filter.

3

Magnus,

When I set up the stdout and ran it was obvious that the _source should not have been used in my event.

So what worked was:
ruby {code => "event['cpu']['system_p'] = event['cpu']['system_p'].to_f * 100"}

Many thanks for helping me to get there :slight_smile:

Thanks,

Mick