Issue with json arrays

Elastic Stack Logstash
1

Hi guys,

i have issue with parssing json with logstash.
here is my logstash configuration:
input {
beats {
port => "5044"
}
}

filter {
ruby {
init => "
def arrays_to_hash(h)
h.each do |k,v|
# If v is nil, an array is being iterated and the value is k.
# If v is not nil, a hash is being iterated and the value is v.
value = v || k
if value.is_a?(Array)
# "value" is replaced with "value_hash" later.
value_hash = {}
value.each_with_index do |v, i|
value_hash[i.to_s] = v
end
h[k] = value_hash
end

        if value.is_a?(Hash) || value.is_a?(Array)
          arrays_to_hash(value)
        end
      end
    end
  "
  code => "arrays_to_hash(event.to_hash)"
 }

}

output {
elasticsearch {
hosts => [ "x.x.x.x:9200" ]
}
}

attached an error when restarting the service:
[2019-06-12T12:44:34,939][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 17, column 20 (byte 394) after filter {\n ruby {\n init => "\n def arrays_to_hash(h)\n h.each do |k,v|\n # If v is nil, an array is being iterated and the value is k.\n # If v is not nil, a hash is being iterated and the value is v.\n value = v || k\n if value.is_a?(Array)\n # "", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:inblock in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:inexclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:inblock in converge_state'"]}

please advise thank you all!!!

2

You need to use \" rather than ", or else surround your init block with ' rather than ".

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.