Proper way to create new event from Logstash Ruby filter

Elastic Stack Logstash
1

Hi,

I would like to somehow create new event with Logstash Ruby filter but actually with no success. I tried a lot of versions and syntaxes, searched for many online topics and documentations and the result is the same.
For example one code snippet for this purpose:

new_custom_event = LogStash::Event.new()
new_custom_event.set("cpu_test_load", 34)
new_event_block.call(new_custom_event)

I did not get any errors with this one, finally syslog shows the new event with "cpu_test_load", "@timestamp" and "@version" fields but Kibana does not show it within the destination index pattern. What do I wrong? Could anybody help with this problem?

Thanks in advance.

2

I have never had any success creating new events with the code option of a ruby filter. All the posts that explain how to do it appear to discuss techniques that are no longer valid.

However, you can definitely create new events if you use the path option to a ruby filter, since that has to return an array of events.

3

Thank you. Maybe i will try it but my opinion is that it should work this way as well. Syslog shows the created new event with minimal field list, it seems that only Kibana drops it. Why? :smiley: I think there is only one small setting related or any other problem which cause the situation.

4

I found an alternative solution. :slightly_smiling_face:

First, it is necessary to build such structure (array of hashes via Ruby filter) from what we want to create new events - for each hash object it is important to place an index value, otherwise we will get Elasticsearch indexing errors after Logstash restart. When the structure is completed, this array should be inserted into existing event via event.set. That's all for Ruby filter.
After then we need to apply split filter on existing event and within field attribute, define previous array of hash objects. Logstash will make as many events as array elements has.

Hope, it will useful for others as well.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.