GitsBdr
(Guillaume Baudringhien)
August 2, 2019, 3:30pm
1
Hi all,
Trying to do something like a switch case as below :
if value < 1 then field = 'low' else if value >= 1 && < 20 then field = 'medium' else if value >= 20 && < 50 then field = 'high' else field = 'veryHigh'
but with the ruby code plugin
So far what I got :
event.set('field', (event.get('value').nil?) ? nil : (event.get('value') < 1000000) ? 'Low' : (event.get('value') >= 1000000 && event.get('value') < 20000000) ? 'Medium' : (event.get('value') >= 20000000 && event.get('value') < 50000000) ? 'High' : 'VeryHigh')
but my output contains "tags":["_rubyexception"]}
Thanks
Jenni
August 2, 2019, 3:56pm
2
I didn't try it, but I guess there would have to be some more brackets around each step of the way so solve this with a long long long one-liner, but reading that hurts anyway. Would it be horrible to use the long version?
if event.get('value').nil? then
event.set('field', nil)
elsif event.get('value') < 1000000 then
event.set('field', 'Low')
elsif … etc etc etc …
…
end
Badger
August 2, 2019, 4:09pm
3
That ruby works just fine, although I would agree with Jenni that it is ugly and it would be better to do it with and if-else if-else if.
What does the rest of the ruby filter look like and what error message does it log?
You will get "comparison of String with 1000000 failed" if value is a type of String.
GitsBdr
(Guillaume Baudringhien)
August 5, 2019, 1:52pm
4
Hi @Jenni and @Badger and thanks for answering
The other part of my ruby code should be alright. I've been using it perfectly so far without errors.
I'll try your version, I agree with you
Let me few minutes to try it out
Thanks
GitsBdr
(Guillaume Baudringhien)
August 5, 2019, 2:48pm
5
Still got the same ...
input {
generator {
lines => [ "test,value,tset","aaaaa,1,aaaaa","bbb,,bbb","ccc,1000050,ccc","ddd,20000050,ddd","eee,50009000,eee"]
count => 3
type => "test"
}
}
filter {
if [type] == "test" {
csv {
skip_header => "true"
separator => ","
columns => ["test", "value", "tset"]
}
ruby { code => "
if event.get('value').nil? then
event.set('field', nil)
elsif event.get('value') < 1000000 then
event.set('field', 'Low')
elsif event.get('value') >= 1000000 && event.get('value') < 20000000 then
event.set('field', 'Medium')
elsif event.get('value') >= 20000000 && event.get('value') < 50000000 then
event.set('field', 'High')
else event.set('field', 'VeryHigh')
end
" }
}
}
output { if [type] == "test" { stdout { codec => json_lines } } }
Badger
August 5, 2019, 2:59pm
6
[ERROR][logstash.filters.ruby ] Ruby exception occurred: comparison of String with 1000000 failed
Are you reading the error message? Add this to your csv filter
convert => { "value" => integer }
GitsBdr
(Guillaume Baudringhien)
August 5, 2019, 3:03pm
7
Can't believe I didn't see this error before ...
Working as expected now
Many thanks to both !
system
(system)
Closed
September 2, 2019, 3:03pm
8
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.