Hi folks,
does anyone have experience regarding the performance of grok/plugins vs. Ruby scripts (https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) and can share some insights on that. I did not do excessive testing on that, but looking at my statistics it looks like code for example for parsing URLs runs a lot faster as Ruby script compared to a Grok statement.
And does anyone know what happens to a Ruby script during Logstash run-time? As this is JRuby and runs on a Java VM, are classes generated out of the script or something like that and instances of that classes created on each call?
And is it a good practice to move code from Logstash configurations to Ruby scripts? It feels like that, because it seems to run faster, Ruby is much more expressive than Logstash's configuration language and finally one can provide excessive test suites with the Ruby script that run on Logstash's startup. Even without the other pros, being able to write tests is a reason to move to Ruby scripts, right?
Any advice is appreciated!
Cheers,
Martin