Restrictions on the Code block in Ruby filter

Elastic Stack Logstash
1

The code that can be put into the ruby filter [1] - are there restrictions on it in any way, such as say it should be relatively simple/short? Can I put multi line ruby code in there? How do I require other gems in the code block?

[1]

filter {
  ruby {
    code => ...
  }
}
2

Hello, currently there is no restrictions about the code or the size of the code.
If your code require some gems that are not included with logstash it is much easier to write your own plugin than to use the ruby filter.

3

if your code is multiples lines you can use ; to separate the lines.

filter {
ruby { 
init => "@test = 0"
code = "event['counter'] = @test; @test +=1"
}

If you need specific gems use theses guides to write your plugins.
https://www.elastic.co/guide/en/logstash/current/contributing-to-logstash.html

If you are familiar with ruby, the plugins are simple gems.

1 Like