Loop through fields using ruby resource?

Elastic Stack Logstash
1

Hi there!

I want to apply a gsub to ALL fields in my logstash object arbitrarily. I know logstash has no tool for loops like that, but I thought I could perhaps do it in a ruby resource?? Something like:

code => "
event.each {|field|
field.gsub!("replaceThis", "withThis") }
"

however I have not as of yet been able to find the correct syntax for the loop. I've already verified that the gsub I use is good.

Any help appreciated!!! Thanks!

2

When you call .each on a hash the iterator will be a two-element array of a key/value pair, so field.gsub won't work. Do you want to perform the gsub on the field names or the field values?

3

I would like to alter the field values.

4

In that case I'd try this:

event.each { |k, v|
  event[k] = v.gsub!("replaceThis", "withThis")
}
3 Likes