Need some help with Ruby event.set / get to use multiplication in config

Elastic Stack Logstash
1

Currency and Gross_Value are existing fields:

mutate { 
add_field => {"Gross_Euro" => "" }}
mutate {
convert => { "Gross_Euro" => "float" }}
if "INR" in [Currency] {
ruby { code => "event ['Gross_Euro'] = event['Gross_Value'] * 0,01221"} }

With above I get a [0] "_rubyexception"

[2019-01-21T12:07:30,690][ERROR][logstash.filters.ruby ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

Ahh ok try this:

if "INR" in [Currency] {
	    ruby {
			"event.set ('[Gross_Euro]' = event.get('[Gross_Value]' * 0,01221))"
		}
}

and this:

if "INR" in [Currency] {
	    ruby {
			"event.set ('[Gross_Euro]' = event.get('[Gross_Value]') * 0,01221)"
		}
}

and this:

if "INR" in [Currency] {
	    ruby {
			"event.set ('[Gross_Euro]') = event.get('[Gross_Value]') * 0,01221"
		}
}

nope !

I now something is wrong but dunno what exactly.

Thanks for any hint

Regards

2

The syntax is

 event.set("fieldname", "fieldvalue")

Also, you will need to use 0.1221 instead of 0,1221. And it might need a .to_f in there as well.

1 Like
3

Thanks for reply, that pushed me to investigate a bit deeper :slight_smile:
I did a few different syntaxes and then found one that fits to my needs:

My first mistake: I forget "code =>" in front of "event" and finaly used following expression.

if "INR" in [Currency]{
	    ruby {
			code => "event.set('Gross_Euro', event.get('Gross_Value') * 0.01221)"
		}	
}

Here wo go
Nice day to you

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.