Logstash 6.2.4 Ruby Issue

[MariumHassan]

Hi,
I have a Logstash script in which I have created some ruby functions. I have placed them at the beginning of my logstash filter so in this way, they are declared before they are called.

The script works fine when I run it using logstash-5.5.2 but when I try to run it using logstash-6.2.4, it starts giving me method undefined error which I can't seem to resolve.

Any help in this matter will be appreciated.
Thank you in anticipation.

[magnusbaeck (Magnus Bäck)]

How could we possibly help out without knowing a) what your Logstash configuration looks like and b) what exact error message you're getting?

[MariumHassan]

Below is my Logstash configuration:

input
{
  beats 
  {
    port => 5044
  }
}
filter
{
  ruby
  {
    code => "def setLogStatus(event, map)
                 if event.get('port') =~ /\d/
                    event.set('status','ORDER_ID_LOG_SENT');
                 else
                    event.set('status','ORDER_ID_LOG_RECEIVED');
                 end
             end"
  }

  # some other functions & grok here
  
  grok
  {
    match => ["message", "method=%{DATA:event}, %{DATA:data}, to local server: http://(?:%{IPV6}|%{IPV4}):%{NOTSPACE:port}/%{DATA:data}"] 
  }   
	
  ruby
  { 
    code => "setLogStatus(event, @@map);"
  }
}
output
{
  elasticsearch 
  { 
    hosts => ["${ELASTICSEARCH_URL}"]
    index => "${INDEX_NAME}-%{+YYYY-MM-dd}"
  }
}

The error I get is following:
Ruby exception occurred: undefined method `setLogStatus' for #LogStash::Filters::Ruby:0x4f112952

[magnusbaeck (Magnus Bäck)]

Stuff inside code doesn't survive between different ruby filters. I think it'll work if you instead put it in the ruby filter's init option, but I don't understand why you're complicating things. What's the point of defining a function instead of just inlining the code in the ruby filter where you need the code?

[MariumHassan]

I have a file which has almost 800 lines of code so inlining the code is not a good idea for me specially if I consider re-usability.

Yes, you are right. Stuff inside code doesn't survive between different ruby filters but what I don't understand is how it was working in the previous version of logstash.

Also, I tried it in init but it wasn't working so I had to use inline option.