Logstash changing Object events using ruby not working

Elastic Stack Logstash
1

Hello,

I am having the below logstash filter ruby code to change the name of an event with Object type but im still getting an error. Am i doing something wrong?

                if [body][json][attr][config] {

                  ruby {
                    code => '
                              if event.get("[body][json][attr][config]").is_a? Hash
                                 event.set("[body][json][attr][configObj]", event.get("[body][json][attr][config]"))
                                 event.remove("[body][json][attr][config]")
                              end
                              '
                      }
                    }

event:

"body" => {
  "json" => {
            "attr" => {
                "config" => {
                                               "version" => 2147479956,
                                               "members" => [
                        [0] {
                              "slaveDelay" => 0,
                             "arbiterOnly" => false,
                                   "votes" => 1,
                                     "_id" => 0,
                            "buildIndexes" => true,
                                    "host" => "vsp-mongo:27017",
                                    "tags" => {},
                                  "hidden" => false,
                                "priority" => 1.0
                        }
                    ],
                                       "protocolVersion" => 1,
                                              "settings" => {
                              "heartbeatTimeoutSecs" => 10,
                             "electionTimeoutMillis" => 10000,
                              "catchUpTimeoutMillis" => -1,
                        "catchUpTakeoverDelayMillis" => 30000,
                                   "chainingAllowed" => true,
                                 "getLastErrorModes" => {},
                                      "replicaSetId" => {
                            "$oid" => "60958c4ee9358cb7eb8c0c82"
                        },
                              "getLastErrorDefaults" => {
                                   "w" => 1,
                            "wtimeout" => 0
                        },
                           "heartbeatIntervalMillis" => 2000
                    },
                                                   "_id" => "rs0",
                    "writeConcernMajorityJournalDefault" => true
                }
            }
         }

Error:
[2021-09-17T05:27:10,421][WARN ][logstash.outputs.amazonelasticsearch][main][0d87ed96dbfc401c0cffdf63ec8dff177cc30ab5fcb20c6ee982a7ce132c50fa] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"gitlab-2021.34", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x78740921>], :response=>{"index"=>{"_index"=>"gitlab-2021.34", "_type"=>"_doc", "_id"=>"vaQ58nsBvYBhKXMZDX4b", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [body.json.attr.config] of type [text] in document with id 'vaQ58nsBvYBhKXMZDX4b'. Preview of field's value: '{settings={heartbeatTimeoutSecs=10, catchUpTimeoutMillis=-1, catchUpTakeoverDelayMillis=30000, getLastErrorModes={}, getLastErrorDefaults={wtimeout=0, w=1}, electionTimeoutMillis=10000, chainingAllowed=true, replicaSetId={$oid=60958c4ee9358cb7eb8c0c82}, heartbeatIntervalMillis=2000}, writeConcernMajorityJournalDefault=true, members=[{hidden=false, buildIndexes=true, arbiterOnly=false, host=vsp-mongo:27017, slaveDelay=0, votes=1, _id=0, priority=1.0, tags={}}], protocolVersion=1, _id=rs0, version=2147479956}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1607"}}}}}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.