There are syntax errors in your ruby code that will cause logstash to crash. If I fix them
input { generator { count => 1 lines => [ '' ] } }
filter {
#mutate { add_field => { "body" => '[{"field": {"key1": "value1", "key2": "value2"}}]' } }
mutate { add_field => { "body" => '[{"field": null }]' } }
json{ source => "body" target => "some" }
ruby {
code => "
if (event.get('some').kind_of?(Array))
if (!event.get('some')[0].nil?)
if (!event.get('some')[0]['field'].nil?)
mapped = event.get('some').map { |h| { 'some_value' => h['field']['key1'], 'another_value' => h['field']['key2'] } };
event.set('mapped',mapped)
else
raise Exception.new 'Non-empty Array type without expected schema:'+ event.get('some').to_s
end
end
end
"
}
}
output { stdout { codec => rubydebug { metadata => false } } }
then I do get an error logged
[ERROR][logstash.filters.ruby ][main][ae9d0609338ac65d4f73d4911a57e44fce57dd39876d923c3802769de68bf55a] Ruby exception occurred: Non-empty Array type without expected schema:[{"field"=>nil}]