# Logstash 5 ruby filter **URL:** \ **Category:** Logstash\ **Created:** [February 28, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851 "2017-02-28T18:51:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [February 28, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851/1 "2017-02-28T18:51:32Z")
Hi All, I have the following code in my logstash config and the ruby part causes logstash to continuously restart, if I remove the ruby part it works just fine. There are no errors in the log what so ever, shall I report a bug for this? Or is there something I do wrong here? > ``` > if [message] =~ /^<=/ { > dissect { > mapping => { > "message" => "%{exim_flag} %{enveloppe_sender_address} %{message}" > } > } > grok { > match => { > "message" => ".+ \[(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\] .+ S=(?\d+) .+ T=(?.+) for (?.+)" > } > } > > ``` > ``` > mutate { > replace => { "exim_flag" => "arrival" } > } > > ``` > ``` > if [subject] =~ /utf-8/ { > ruby { > init => "require 'mail'" > code => "event.set('subject_decoded') =Mail::Encodings.value_decode(event.get('subject'))" > } > } > } > > ``` root@logstash1:/opt/logstash/logs# /usr/share/logstash/bin/logstash -V logstash 5.2.1 Plugins: logstash-codec-cef logstash-codec-collectd logstash-codec-dots logstash-codec-edn logstash-codec-edn\_lines logstash-codec-es\_bulk logstash-codec-fluent logstash-codec-graphite logstash-codec-json logstash-codec-json\_lines logstash-codec-line logstash-codec-msgpack logstash-codec-multiline logstash-codec-netflow logstash-codec-plain logstash-codec-rubydebug logstash-filter-cidr logstash-filter-clone logstash-filter-csv logstash-filter-date logstash-filter-dissect logstash-filter-dns logstash-filter-drop logstash-filter-fingerprint logstash-filter-geoip logstash-filter-grok logstash-filter-json logstash-filter-kv logstash-filter-metrics logstash-filter-mutate logstash-filter-ruby logstash-filter-sleep logstash-filter-split logstash-filter-syslog\_pri logstash-filter-throttle logstash-filter-urldecode logstash-filter-useragent logstash-filter-uuid logstash-filter-xml logstash-input-beats logstash-input-couchdb\_changes logstash-input-elasticsearch logstash-input-exec logstash-input-file logstash-input-ganglia logstash-input-gelf logstash-input-generator logstash-input-graphite logstash-input-heartbeat logstash-input-http logstash-input-http\_poller logstash-input-imap logstash-input-irc logstash-input-jdbc logstash-input-kafka logstash-input-log4j logstash-input-lumberjack logstash-input-pipe logstash-input-rabbitmq logstash-input-redis logstash-input-s3 logstash-input-snmptrap logstash-input-sqs logstash-input-stdin logstash-input-syslog logstash-input-tcp logstash-input-twitter logstash-input-udp logstash-input-unix logstash-input-xmpp logstash-output-cloudwatch logstash-output-csv logstash-output-elasticsearch logstash-output-file logstash-output-graphite logstash-output-http logstash-output-irc logstash-output-kafka logstash-output-nagios logstash-output-null logstash-output-pagerduty logstash-output-pipe logstash-output-rabbitmq logstash-output-redis logstash-output-s3 logstash-output-sns logstash-output-sqs logstash-output-statsd logstash-output-stdout logstash-output-tcp logstash-output-udp logstash-output-webhdfs logstash-output-xmpp logstash-patterns-core ---
**Author:** ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)\ **Post date:** [February 28, 2017, 7:25pm UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851/2 "2017-02-28T19:25:51Z")
See if you can generate more logging by running Logstash in debug mode. DEBUG=1 ./logstash.... ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [February 28, 2017, 8:52pm UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851/3 "2017-02-28T20:52:52Z")
Thanks, that helps a lot... Apparently there is something wrong with this: `event.set('subject_decoded') =Mail::Encodings.value_decode(event.get('subject'))` > DEBUG: exec /usr/share/logstash/vendor/jruby/bin/jruby /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash/ -f . > Sending Logstash's logs to /opt/logstash/logs which is now configured via log4j2.properties > SyntaxError: (ruby filter code):1: syntax error, unexpected '=' > @codeblock = lambda { |event, &new\_event\_block| event.set('b64\_decoded') = Base64.decode64(event.get('subject')) } > ^ > eval at org/jruby/RubyKernel.java:1079 > register at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-3.0.2/lib/logstash/filters/ruby.rb:38 > register at /usr/share/logstash/vendor/jruby/lib/ruby/1.9/forwardable.rb:201 > start\_workers at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235 > each at org/jruby/RubyArray.java:1613 > start\_workers at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235 > run at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:188 > start\_pipeline at /usr/share/logstash/logstash-core/lib/logstash/agent.rb:302 Going to do some more digging and fiddeling... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 1, 2017, 6:55am UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851/4 "2017-03-01T06:55:20Z")
> ``` > event.set('subject_decoded') =Mail::Encodings.value_decode(event.get('subject')) > > ``` That's indeed not the correct syntax. Change to: ``` event.set('subject_decoded', Mail::Encodings.value_decode(event.get('subject'))) ``` See: [Event API | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-api.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 29, 2017, 6:55am UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851/5 "2017-03-29T06:55:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.