My own logstash filter doesn't extract the input field value correctly

Elastic Stack Logstash
1

Hello folks,

I have built my own plugin filter for logstash. The principle of this
filter is to get some coordinates (x,y) formated in a coordinates
system called "lambertII" and to convert them in gps system (latitude,
longitude). Here is an example:

lambert {
    convert => ["lambertII", x, y]
    latitude => ["lat"] #return as output latitude
    longitude => ["long"] #return as output longitude
}

It works well when I write for instance:

 convert => ["LambertII", 2478517.33, 547536.68]

However, when I extract data from a json file as shown below

{"x":2478517.33, "y":547536.68}
{"x":2699120.65, "y":544959.56}

but it does not work, when I write:

 convert => ["LambertII", "%{[x]}", "%{[y]}"]

or

convert => ["LambertII", "%{x}", "%{y}"]

Indeed, my ruby code does not extract the float value from the
expressions "%{[..]}" or "%{..}" but it interprets them like string
expressions.

I have already seen this following link but it didn't solve my problem: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#event-dependent-configuration

I didn't find out how to solve this problem. I would be very thankful for any help.

Thank you for your attention and your help !

PS: I can provide my ruby code lambert.rb if it is usefull

2

It seems you're not calling event.sprintf() on the field values.

1 Like
3

thank you very much Magnus, I was so stuck :smiley: !