Reading a properties file using logstash

I am trying to to read a properties file using log stash, but getting some error as shown below

Could you please help me in resolving this issue.
As i want to read a properties file (using ruby code as shown in below script) .
Get the key and value, based on the key need to put the value in the "Category" column.

sample.properties

AGSS=SOFTWARE
NGSS=HARDWARE

===============================

logstash-nationwide.conf

input {
    file {
        path => "C:\ELK\DataSets\NATIONWIDE_Incidents_Data_few_Fields.csv"
        start_position => beginning
		sincedb_path=>"dev/null"
    }
}

filter {
  csv {
	   columns => ["Incident ID","Status","Resolved By","Resolution Breached","Resolution Month","Resolution Date","Resolution Date & Time","Resolution Year","Resolution Week","Assignment Group","Assignee Name","Priority","Open Date & Time","Days Since Opened","Open to Resolve Time","Average Days Open","Resolution Minutes","Suspended Minutes","Open Month","Open Week","Owning Group","Incident ID","Knowledge ID","Knowledge Title","Category","SubCategory","Product Type","Problem Type","Cause Code","Fix Type","Resolution Analysis Code","Closure Code","Primary CI"]
	 
	 separator => ","
	 
	 convert => { 
			"Priority" => "integer"
		}
  
  }
  
	ruby {
    code => "
	event["keyvalue"] = File.open("C:\ELK\logstash-5.2.0\config\sample.properties", &:readline)
	mutate {
				update => { "Category" => event["keyvalue"]}
			}
    "
}

............

Please help me in reading the file getting the value based on key so that i can update in required column.
Thanks in advance.

If you use double quotes to surround your code block in your ruby filter you can't use double quotes in the code itself. Use single quotes in either place, i.e. either

code => "event['keyvalue'] = ..."

or

code => 'event["keyvalue"] = ...'

Thanks Magnus... I modified the code as suggested ..
It worked for me...

ruby {
    code => '
	file = File.open("/C:\\ELK\\DataSet\\sample.properties", "r")
	data=file.read
	file.close
      event.set("Category",data)
    '
	} 

Thanks for your help.. :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.