# Logstash - grok - ruby and random numbers

**URL:** <https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367>\
**Category:** Logstash\
**Created:** [September 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367 "2020-09-03T10:36:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![BBQigniter](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\
**Post date:** [September 3, 2020, 10:36am UTC](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367/1 "2020-09-03T10:36:02Z")

</div>

hello,

maybe someone has an idea here.

we use following setup for our log-filtering:

`source -- (dns-rr) --> 3 x logstash -> 3-node-rabbitmq-cluster -> 3 x logstash -> elasticsearch-cluster`

on the 3-node rabbitmq-cluster for example we have setup an exchange with x-modulus-hash and e.g. 1 queue on each node which is bound the the exchange.

on the first logstash hosts which are pushing the messages to rabbitmq I use

```auto
    ruby {
        code => "event.set('random_number', rand(100).to_s())"
    }

```

for creating a random-number which is used as the routing-key for the messages. rabbitmq then does some magic with the key submitted and puts the message in on of the queues.

we now experience following on the filtering logstash nodes that fetch those messages from the rabbitmq:

- logstash filter node 1 has the most load
- logstash filter node 2 a little bit less
- logstash filter node 3 even less

now i had a look at ruby's rand-funciton and searched for info about it. the internet says that this function can make problems. and so i looked at the random\_number field values in kibana and really - the random number distribution from 1-99 for example is not very nice

 ![ruby_rand_numbers](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1776fc843e859b8567b35c10debf2918d3994d1.jpeg)

so I wanted to ask if anyone here has seen something similar or has some other idea to generate "real" random numbers to get a better distribution of the events?

thanks for any input 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 10:36am UTC](https://discuss.elastic.co/t/logstash-grok-ruby-and-random-numbers/247367/2 "2020-10-01T10:36:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.