# Problem using external Ruby script in Logstash **URL:** \ **Category:** Logstash\ **Created:** [February 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387 "2020-02-14T14:39:13Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [February 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/1 "2020-02-14T14:39:13Z")
Hello guys, I'm having problem trying to get my ruby code filter into an external ruby file called test2.rb When i was using a ruby {} inside my configuration, it was working very well, and i am new to ruby so maybe my mistakes are basics and i am sorry for this. In my logstash.conf i'm calling ruby this way : ```auto ruby { path => "C:\Users\T6SH\Desktop\Logstash\Ruby\test2.rb" } ``` Then my test2.rb looks like : ```auto def filter(event) if event.get("[event][dataset]") == "system.process" if event.get("[process][name]").downcase == "svchost.exe" event.set("process.w3wp_application_pool", event.get("[process][args]")[event.get("[process][args]").index("-k")+1]) event.set("process.app_name", "svchost - " + event.get("[process][args]")[event.get("[process][args]").index("-k")+1]) return [event] elsif event.get("[process][name]").downcase == "java.exe" if event.get("[process][args]").include?("-jar") event.set("process.java_app_name", event.get("[process][args]")[event.get("[process][args]").index("-jar")+1]) event.set("process.app_name", "java - " + event.get("[process][args]")[event.get("[process][args]").index("-jar")+1]) return [event] elsif event.get("[process][args]").include?("-cp") event.set("process.java_app_name", event.get("[process][args]")[event.get("[process][args]").index("-cp")+2]) event.set("process.app_name", "java - " + event.get("[process][args]")[event.get("[process][args]").index("-cp")+2]) return [event] end else return event.set("process.app_name", event.get("[process][name]")) end elsif event.get("[event][dataset]") == "windows.service" if event.get("[windows][service][name]").downcase.start_with?("fgs","elasticsearch","w3svc","metricbeat","sos_scheduler_","msmq","msdtc") return [event.set("windows.service.is_critical", true)] else return [event.set("windows.service.is_critical", false)] end end end ``` My error : ```auto Could not process event: Custom script did not return an array from 'filter'. Only arrays may be returned! backtrace=>["C:/Users/T6SH/Desktop/Logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:69:in `check_result_events!'", "C:/Users/T6SH/Desktop/Logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:101:in `file_script'", "C:/Users/T6SH/Desktop/Logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.5/lib/logstash/filters/ruby.rb:84:in `filter'", "C:/Users/T6SH/Desktop/Logstash/logstash-core/lib/logstash/filters/base.rb:143:in `do_filter'", "C:/Users/T6SH/Desktop/Logstash/logstash-core/lib/logstash/filters/base.rb:162:in `block in multi_filter'", "org/jruby/RubyArray.java:1800:in `each'", "C:/Users/T6SH/Desktop/Logstash/logstash-core/lib/logstash/filters/base.rb:159:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:115:in `multi_filter'", "C:/Users/T6SH/Desktop/Logstash/logstash-core/lib/logstash/java_pipeline.rb:243:in `block in start_workers'"]} ``` Before this i had a return for every event.set, but i didnt return array so i tried to had them in array then i tried to return like above an [event] array but i m losing my mind ...I feel like im coding blindly... I hope i was clear enough, thanks for your future help and have a nice day ! Sincerly trying, Luigi ---
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [February 14, 2020, 2:57pm UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/2 "2020-02-14T14:57:48Z")
Hi again , I would like to add that my script is partially working... I mean when the process.name is svchost or java or not both, it runs the script i wanted, even if i stop all services and delete index patterns and datas... Then the part where event.dataset == windows.service is working too .... I must have a code that isnt working in all cases i dont know .. I hope this message will help you understand my problem .. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 14, 2020, 4:31pm UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/3 "2020-02-14T16:31:14Z")
> [@LuigiDelavega](#): > > return event.set("process.app\_name", event.get("[process][name]")) The script has to return an array of events. It is likely you will want all of them to be ``` return [event] ``` ---
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [February 17, 2020, 9:31am UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/4 "2020-02-17T09:31:44Z")
Hi @Badger, Indeed i missed this one, sorry for this mistake. I re wrote my code a little bit to return only [event] array, but still got an error. my file test2.rb : ```auto def filter(event) if event.get("[event][dataset]") == "system.process" if event.get("[process][name]").downcase == "svchost.exe" event.set("process.w3wp_application_pool", event.get("[process][args]")[event.get("[process][args]").index("-k")+1]) event.set("process.app_name", "svchost - " + event.get("[process][args]")[event.get("[process][args]").index("-k")+1]) return [event] elsif event.get("[process][name]").downcase == "java.exe" if event.get("[process][args]").include?("-jar") event.set("process.java_app_name", event.get("[process][args]")[event.get("[process][args]").index("-jar")+1]) event.set("process.app_name", "java - " + event.get("[process][args]")[event.get("[process][args]").index("-jar")+1]) return [event] elsif event.get("[process][args]").include?("-cp") event.set("process.java_app_name", event.get("[process][args]")[event.get("[process][args]").index("-cp")+2]) event.set("process.app_name", "java - " + event.get("[process][args]")[event.get("[process][args]").index("-cp")+2]) return [event] end else event.set("process.app_name", event.get("[process][name]")) return [event] end elsif event.get("[event][dataset]") == "windows.service" if event.get("[windows][service][name]").downcase.start_with?("fgs","elasticsearch","w3svc","metricbeat","sos_scheduler_","msmq","msdtc") event.set("windows.service.is_critical", true) return [event] else event.set("windows.service.is_critical", false) return [event] end end end ``` and the error is still the same : ```auto Could not process event: Custom script did not return an array from 'filter'. Only arrays may be returned! backtrace =>... `check_result_events!' backtrace =>... `file_script' .... backtrace =>... `filter' backtrace =>... `do_filter' ..... backtrace =>... `block in multi_filter' backtrace =>... 'each' ..... backtrace =>... `multi_filter' backtrace =>... `block in start_workers' ``` ---
**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\ **Post date:** [February 17, 2020, 10:17am UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/5 "2020-02-17T10:17:52Z")
Hi You seem to be returning the event in all cases, except when `[event][dataset]` is neither `system.process` nor `windows.service`. If that case is a possibility, you might want to add an `else` to the main `if` in order to `return [event]` there as well. The same for your `[process][args]` when it is neither `-jar` nor `-cp`. Just a thought. ---
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [February 17, 2020, 10:23am UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/6 "2020-02-17T10:23:53Z")
Hi @ITIC, thanks for your message. I had the same idea so i tried to put it to handle all cases but nothing changed.. Then i saw that i wrote it bad (i wrote ' return [event} ') So thanks again to remind me of testing a second time this solution. For all event from the system module that are not process i had to put this ! Have a great day ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 16, 2020, 10:24am UTC](https://discuss.elastic.co/t/problem-using-external-ruby-script-in-logstash/219387/7 "2020-03-16T10:24:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.