# New to elk and need assistance with a ruby re-write

**URL:** <https://discuss.elastic.co/t/new-to-elk-and-need-assistance-with-a-ruby-re-write/103433>\
**Category:** Logstash\
**Created:** [October 10, 2017, 8:00pm UTC](https://discuss.elastic.co/t/new-to-elk-and-need-assistance-with-a-ruby-re-write/103433 "2017-10-10T20:00:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tallan](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tallan](https://discuss.elastic.co/u/tallan)\
**Post date:** [October 10, 2017, 8:00pm UTC](https://discuss.elastic.co/t/new-to-elk-and-need-assistance-with-a-ruby-re-write/103433/1 "2017-10-10T20:00:47Z")

</div>

Hello,

I am pretty new to logstash but am getting the hang of it. I am a total noob with ruby however but I know I am close and just need a little advice from someone. I can't seem to get my code to drop the decimals and can't figure it out. Here is what I have.

if "apache\_access" in [tags] {  
grok {  
match =\> ["message", "%{HOSTNAME:hostname}:%{POSINT} %{IPORHOST:clientip} (?[a-zA-Z0-9.@_-]+) (?[a-zA-Z0-9.@_-]+) [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes:int}|-) %{QS:referrer} %{QS:agent} %{POSINT:sptime:int} %{QS:xforwarded} %{QS:xuuid}" ]  
}  
date {  
match =\> ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]  
timezone =\> "America/Chicago"  
locale =\> "en"

> ```
> }
> # Old working code from LS 2
> # ruby {
> # code => "event['ptime'] = Integer(event['sptime'] * 0.001)"
> # }
> # New code for filebeats
> ruby {
> # code => 'event.set("ptime", event.get("sptime") * 0.001 )'
> code => "event.set('ptime', event.get('sptime') * 0.001)"
> }
> 
> }
> 
> ```

the code works as far as the math goes however I want ptime to be an integer and it is not.  
what I get in the logs are sptime"=\>13148 "ptime"=\>13.148 I just want ptime to be 13

Any advice would be greatly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![tallan](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@tallan](https://discuss.elastic.co/u/tallan)\
**Post date:** [October 10, 2017, 8:36pm UTC](https://discuss.elastic.co/t/new-to-elk-and-need-assistance-with-a-ruby-re-write/103433/2 "2017-10-10T20:36:19Z")

</div>

Well,

I think I finally got what I was after, this seemed to correct my issue

code =\> "event.set('ptime',(event.get('sptime') \* 0.001).round)"

Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 8:42pm UTC](https://discuss.elastic.co/t/new-to-elk-and-need-assistance-with-a-ruby-re-write/103433/3 "2017-11-07T20:42:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.