# Logstash ruby filter something is wrong

**URL:** <https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443>\
**Category:** Logstash\
**Created:** [November 28, 2017, 5:03pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443 "2017-11-28T17:03:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wentao](https://avatars.discourse-cdn.com/v4/letter/w/a9adbd/32.png) [@wentao](https://discuss.elastic.co/u/wentao)\
**Post date:** [November 28, 2017, 5:03pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443/1 "2017-11-28T17:03:23Z")

</div>

my filter is  
filter {  
ruby {  
init =\> "@kname = ['time\_local','domain']"  
code =\> "  
new\_event = Logstash::Event.new(Hash[@kname.zip(event.get('message').split('|'))])  
new\_event.remove('@timestamp')  
event.append(new\_event)  
"  
}  
date {  
match =\> ["time\_local", "dd/MMM/YYYY:HH:mm:ss Z"]  
}  
}

my event is:  
25/Nov/2017:23:50:07 +0800 | [http://test.com](http://test.com)

and the rubydebug is :  
[2017-11-29T00:42:19,855][ERROR][logstash.filters.ruby] Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::Logstash  
{  
"host\_ip" =\> "10.0.201.101",  
"@timestamp" =\> 2017-11-28T16:41:04.224Z,  
"offset" =\> 14703,  
"kafka" =\> {  
"consumer\_group" =\> "logstash\_server",  
"partition" =\> 5,  
"offset" =\> 1561421,  
"topic" =\> "nginx\_log",  
"key" =\> nil  
},  
"beat" =\> {  
"hostname" =\> "cn\_bj\_sjhl\_slb\_g1\_10-0-201-101",  
"name" =\> "cn\_bj\_sjhl\_slb\_g1\_10-0-201-101",  
"version" =\> "5.6.0"  
},  
"input\_type" =\> "log",  
"@version" =\> "1",  
"source" =\> "/mnt/test.log",  
"message" =\> "25/Nov/2017:23:50:07 +0800 | [http://test.com](http://test.com)",  
"type" =\> "nginx-log",  
"tags" =\> [  
[0] "\_rubyexception"  
]  
}  
is there somebody tell my why???????????

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2017, 7:14pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443/2 "2017-11-28T19:14:44Z")

</div>

> new\_event = Logstash::Event.new(Hash[@kname.zip(event.get('message').split('|'))])

Try LogStash instead of Logstash.

---

<div class="post-metadata">

**Author:** ![wentao](https://avatars.discourse-cdn.com/v4/letter/w/a9adbd/32.png) [@wentao](https://discuss.elastic.co/u/wentao)\
**Post date:** [November 29, 2017, 1:45am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443/4 "2017-11-29T01:45:00Z")

</div>

thank you very very much！！

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2017, 1:45am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-something-is-wrong/109443/5 "2017-12-27T01:45:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.