Logstash creates switch case using ruby code

Elastic Stack Logstash
1

Hi all,

Trying to do something like a switch case as below :
if value < 1 then field = 'low' else if value >= 1 && < 20 then field = 'medium' else if value >= 20 && < 50 then field = 'high' else field = 'veryHigh'

but with the ruby code plugin
So far what I got :

event.set('field', (event.get('value').nil?) ? nil : (event.get('value') < 1000000) ? 'Low' : (event.get('value') >= 1000000 && event.get('value') < 20000000) ? 'Medium' : (event.get('value') >= 20000000 && event.get('value') < 50000000) ? 'High' : 'VeryHigh')

but my output contains "tags":["_rubyexception"]}

Thanks

2

I didn't try it, but I guess there would have to be some more brackets around each step of the way so solve this with a long long long one-liner, but reading that hurts anyway. Would it be horrible to use the long version?

if event.get('value').nil? then
  event.set('field', nil)
elsif event.get('value') < 1000000 then
  event.set('field', 'Low')
elsif … etc etc etc …
  …
end
3

That ruby works just fine, although I would agree with Jenni that it is ugly and it would be better to do it with and if-else if-else if.

What does the rest of the ruby filter look like and what error message does it log?

You will get "comparison of String with 1000000 failed" if value is a type of String.

4

Hi @Jenni and @Badger and thanks for answering

The other part of my ruby code should be alright. I've been using it perfectly so far without errors.

I'll try your version, I agree with you
Let me few minutes to try it out

Thanks

5

Still got the same ...

input {
 generator {
   lines => [ "test,value,tset","aaaaa,1,aaaaa","bbb,,bbb","ccc,1000050,ccc","ddd,20000050,ddd","eee,50009000,eee"]
   count => 3
  type => "test"
 }
}
filter {
 if [type] == "test" {
   csv {
     skip_header => "true"
     separator => ","
     columns => ["test", "value", "tset"]
   }
   ruby { code => "
     if event.get('value').nil? then
       event.set('field', nil)
     elsif event.get('value') < 1000000 then
       event.set('field', 'Low')
     elsif event.get('value') >= 1000000 && event.get('value') < 20000000 then
       event.set('field', 'Medium')
     elsif event.get('value') >= 20000000 && event.get('value') < 50000000 then
       event.set('field', 'High')
     else event.set('field', 'VeryHigh')
     end
   " }
  }
}
output { if [type] == "test" { stdout { codec => json_lines } } }
6 
[ERROR][logstash.filters.ruby    ] Ruby exception occurred: comparison of String with 1000000 failed

Are you reading the error message? Add this to your csv filter

convert => { "value" => integer }
7

Can't believe I didn't see this error before ...
Working as expected now
Many thanks to both !