Logstash ruby filter something is wrong

Elastic Stack Logstash
1

my filter is
filter {
ruby {
init => "@kname = ['time_local','domain']"
code => "
new_event = Logstash::Event.new(Hash[@kname.zip(event.get('message').split('|'))])
new_event.remove('@timestamp')
event.append(new_event)
"
}
date {
match => ["time_local", "dd/MMM/YYYY:HH:mm:ss Z"]
}
}

my event is:
25/Nov/2017:23:50:07 +0800 | http://test.com

and the rubydebug is :
[2017-11-29T00:42:19,855][ERROR][logstash.filters.ruby ] Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Logstash
{
"host_ip" => "10.0.201.101",
"@timestamp" => 2017-11-28T16:41:04.224Z,
"offset" => 14703,
"kafka" => {
"consumer_group" => "logstash_server",
"partition" => 5,
"offset" => 1561421,
"topic" => "nginx_log",
"key" => nil
},
"beat" => {
"hostname" => "cn_bj_sjhl_slb_g1_10-0-201-101",
"name" => "cn_bj_sjhl_slb_g1_10-0-201-101",
"version" => "5.6.0"
},
"input_type" => "log",
"@version" => "1",
"source" => "/mnt/test.log",
"message" => "25/Nov/2017:23:50:07 +0800 | http://test.com",
"type" => "nginx-log",
"tags" => [
[0] "_rubyexception"
]
}
is there somebody tell my why???????????

2

new_event = Logstash::Event.new(Hash[@kname.zip(event.get('message').split('|'))])

Try LogStash instead of Logstash.

1 Like
4

thank you very very much！！

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.