Logstash count events using ruby filter

A script file returns an array of events (1 or 2 in this case), so that is an easy way to create a second event.

You may be able to use a new_event_block as described in the code option of an aggregate filter but I have not tested it. I do not know if that is specific to aggregate or whether you can use it a ruby filter. @Jenni's post here suggests it can be used in a ruby filter.

1 Like