# Logstash ruby filter not working
**URL:** https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807
**Category:** Logstash
**Created:** [July 6, 2016, 8:44am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807 "2016-07-06T08:44:52Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)
#### Post date: [July 6, 2016, 8:44am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807/1 "2016-07-06T08:44:52Z")
Hi Team,
I am trying to get the number from the **underscore** in the **\_id,** so I tried using ruby filter to get the number below is the following details,
Sample post data,
POST test\_item/item/149927\_1
{
"ITEM\_ID": 149927,
"ITEM\_CODE": "149927",
"RELATIONSHIP": [
{
"REL\_TYP\_REF\_ID": -999,
"REL\_TYPE": "NO RELATIONSHIP",
"REL\_CTGRY": "NIL"
}
],
"ITEM\_MISUSED\_GTIN\_FLG": "N",
"CRT\_DTTM": "2009-03-25 15:15:32",
"XCD": []
}
If we execute the GET test\_item/item/149927\_1 we will get the \_id field, Since \_id = **149927\_1** is a default field in elasticsearch and it is string type
Below is the logstash config file which I used,
input {
# We read from the "old" index
elasticsearch {
hosts =\> ["10.7.147.21:9200"]
user =\> "esadmin"
password =\> "dev01"
index =\> "test\_item"
size =\> 500
scroll =\> "5m"
docinfo =\> true
}
}
filter {
mutate {
remove\_field =\> ["@timestamp", "@version"]
}
ruby {
code =\> "document\_id = event['%{[@metadata][_id]}']
event['PARTITION\_ID'] = document\_id.split('_').first"
}
}
output {
# We write to the "new" index
elasticsearch {
host =\> "10.7.147.21:9200"
protocol =\> "http"
user =\> "esadmin"
password =\> "dev01"
index =\> "test\_item1"
document\_type =\> "%{[@metadata][\_type]}"
document\_id =\> "%{[@metadata][\_id]}"
}
# We print dots to see it in action
stdout {
codec =\> rubydebug
}
}
I am getting the error when I execute the logstash command, **bin/logstash -f logstash.conf**
**Ruby exception occurred: undefined method `split' for nil:NilClass {:level=\>:error}**
Logstash startup completed
{
"ITEM\_ID" =\> 149927,
"ITEM\_CODE" =\> "149927",
"RELATIONSHIP" =\> [
[0] {
"REL\_TYP\_REF\_ID" =\> -999,
"REL\_TYPE" =\> "NO RELATIONSHIP",
"REL\_CTGRY" =\> "NIL"
}
],
"ITEM\_MISUSED\_GTIN\_FLG" =\> "N",
"CRT\_DTTM" =\> "2009-03-25 15:15:32",
"XCD" =\> [],
"tags" =\> [
[0] "\_rubyexception"
]
}
Logstash shutdown completed
Please help me out to resolve this and correct me if am doing anything wrong in filter section.
Thanks,
Ganeshbabu R
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 6, 2016, 9:45am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807/2 "2016-07-06T09:45:24Z")
> code =\> "document\_id = event['%{[@metadata][\_id]}']
Here you're asking for a field named `%{[@metadata][_id]}` (literally) and there's obviously no such field. One of these should work better:
> code =\> "document\_id = event['@metadata']['\_id']
> code =\> "document\_id = event['[@metadata][\_id]']
Which one you should use might depend on your version of Logstash.
---
### Author:  [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)
#### Post date: [July 6, 2016, 10:27am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807/3 "2016-07-06T10:27:12Z")
Hi @magnusbaeck
We are using ES 1.7.3 with logstash 1.5.5 and yes we didn't indexed "\_id" field and by default elasticsearch itself will have.
In the \_id, we are trying to get the number after the underscore ( \_ ) and you have given two suggestions and I will try it both, which is suitable for logstash 1.5.5.
Thanks,
Ganeshbabu R
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 6, 2016, 9:09pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807/4 "2016-07-06T21:09:43Z")
> [@r.ganeshbabu](#):
>
> logstash 1.5.5
You should really upgrade to 2.X, 1.5 is pretty old these days.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-not-working/54807/5 "2017-07-06T04:49:13Z")