# Logstash Ruby concat & event
**URL:** https://discuss.elastic.co/t/logstash-ruby-concat-event/308816
**Category:** Logstash
**Created:** [July 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816 "2022-07-04T13:06:41Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jsauvebois](https://discuss.elastic.co/u/jsauvebois)
#### Post date: [July 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816/1 "2022-07-04T13:06:41Z")
Hi,
In a first time, I tested how to add a field via ruby code based on existing field **duration** and **event**
```auto
...
ruby {
code => "
if event.get('duration').nil?
event.set('duration_time','')
else
duration_time = event.get('duration').to_i
tmp,seconds = duration_time.divmod(60)
hours, minutes = tmp.divmod(60)
duration_time_s = format('%02d', hours) + ':'+ format('%02d', minutes) + ':' + format('%02d',
seconds)
event.set('duration_time',duration_time_s)
end"}
...
```
It works.
In a second time I would to add a ruby function to call it in all my logstash configuration.
**compute\_duration.rb**
```auto
# the value of `params` is the value of the hash passed to `script_params`
# in the logstash configuration
def register(params)
@compute_duration = params["my_field"]
end
# the filter method receives an event and must return a list of events.
# Dropping an event means not including it in the return array,
# while creating new ones only requires you to add a new instance of
# LogStash::Event to the returned array
def filter(event)
if event.get(@compute_duration).nil?
event.set(@compute_duration.concat('_time'),'')
else
time_l = event.get(@compute_duration).to_i
tmp,seconds = time_l.divmod(60)
hours, minutes = tmp.divmod(60)
time_s = format('%02d', hours) + ':'+ format('%02d', minutes) + ':' + format('%02d', seconds)
event.set(@compute_duration.concat('_time'),time_s)
end
return [event]
end
```
**logstash configuration**
```auto
ruby {
# compute interval time
path => "/usr/local/analytics/logstashjobs/ruby_code/compute_duration.rb"
script_params => { "my_field" => 'duration' }
}
```
My logstash configuration retrieve data from CSV file. The first document is ok, but after something strange happen. My new field is concatenated for all others documents like this
```auto
duration_time
duration_time_time
duration_time_time_time
duration_time_time_time_time
...
```
I work with the stack ELK 7.0.1.
If someone has an idea
Regards,
Julien
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2022, 4:40pm UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816/2 "2022-07-04T16:40:45Z")
The ruby String [concat](https://ruby-doc.org/core-3.1.2/String.html#method-i-concat) method modifies the string it is called on (note that _s_ is modififed). Try using [+](https://ruby-doc.org/core-3.1.2/String.html#method-i-2B) instead of concat.
---
### Author:  [@jsauvebois](https://discuss.elastic.co/u/jsauvebois)
#### Post date: [July 25, 2022, 9:30am UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816/3 "2022-07-25T09:30:58Z")
Hi Badger,
Sorry for the delay and thank you your feedback 😀
I'll check it ASAP.
Regards,
Julien
---
### Author:  [@jsauvebois](https://discuss.elastic.co/u/jsauvebois)
#### Post date: [August 1, 2022, 9:42am UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816/4 "2022-08-01T09:42:24Z")
It works fine. Thank you for your help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2022, 9:42am UTC](https://discuss.elastic.co/t/logstash-ruby-concat-event/308816/5 "2022-08-29T09:42:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.