# Ruby API call when parser hit specific field **URL:** \ **Category:** Logstash\ **Created:** [May 23, 2023, 10:48am UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107 "2023-05-23T10:48:30Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Jirka\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jirka_liska/32/117513_2.png) [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Post date:** [May 23, 2023, 10:48am UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/1 "2023-05-23T10:48:30Z")
Hi, I'm trying to have Logstash make API call when it hits specific field using Ruby code but I'm unable to do so. Could someone smarter than me check what I'm doing wrong please? Ruby code: ```auto require 'uri' require 'net/http' def register(params) @pk = params["pk"] end def filter(event) uri = URI('http://rest_api:8000/api/') res = Net::HTTP.post_form(uri, 'report_status' => 'PROCESSED') puts res.body if res.is_a?(Net::HTTPSuccess) end ``` Logstash filter: ```auto grok { match => { "[log][file][path]" => ["(?:%{BASE10NUM:PK}-)"] } } if [EOF] == 'EOF' { ruby { path => "/usr/local/supporting-scripts/isotropy-webhook.rb" script_params => { "PK" => "pk" } } } ``` Log example: ```auto fd1c6aeb-c9c4-4c1c-8451-7899dc71cb0b,12/2/2022 9:13:34 PM,13,DlpRuleMatch,test@test.com,"{""CreationTime"":""2022-12-02T21:13:34"",""Id"":""1-1c-8451-1"",""Operation"":""DlpRuleMatch"",""OrganizationId"":""1-1-1-1-1"",""RecordType"":13,""UserKey"":""1-1c-8451-1"",""UserType"":4,""Version"":1,""Workload"":""Exchange"",""ObjectId"":""<1@1.1.1.1.COM>"",""UserId"":""test@test.com"",""IncidentId"":""1-1c-8451-1"",""PolicyDetails"":[{""PolicyId"":""6a9c7f84-4d04-487c-9b1e-6dc4884e5c44"",""PolicyName"":""DLP_Exclude_Autoreplies_Ex_Cx"",""Rules"":[{""Actions"":[""Halt""],""ConditionsMatched"":{""ConditionMatchedInNewScheme"":false,""OtherConditions"":[{""Name"":""AccessScope"",""Value"":""IncludeExternalUsers""},{""Name"":""ExtendedItem.ExMessage.MessageType"",""Value"":""AutomaticReply""}]},""ManagementRuleId"":""1-1c-8451-1"",""RuleId"":""1-1c-8451-1"",""RuleMode"":""Enable"",""RuleName"":""DLP_Exclude_Autoreplies_Ex_Cx"",""Severity"":""Low""}]}],""SensitiveInfoDetectionIsIncluded"":false,""ExchangeMetaData"":{""BCC"":[],""CC"":[],""FileSize"":44224,""From"":""test@test.com"",""MessageID"":""<1-1c-8451-1@1-1c-8451-1.1-1c-8451-1.1-1c-8451-1.1-1c-8451-1.COM>"",""RecipientCount"":1,""Sent"":""2022-12-02T21:13:33"",""Subject"":""Automatic reply: [Test] Test"",""To"":[""test@test.com""],""UniqueID"":""a1df2cb7-73ef-4d58-068b-08dad4aa11eb""}}",""EOF"":""EOF"", ``` Thanks in advance! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 23, 2023, 3:04pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/2 "2023-05-23T15:04:44Z")
> [@Jirka\_Liska](#): > > `"PK" => "pk"` Your ruby script defines the parameter names as "pk", not "PK". ---
**Author:** ![Jirka\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jirka_liska/32/117513_2.png) [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Post date:** [May 23, 2023, 3:57pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/3 "2023-05-23T15:57:05Z")
thanks, anyway this changed nothing... ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 23, 2023, 4:01pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/4 "2023-05-23T16:01:45Z")
> [@Jirka\_Liska](#): > > thanks, anyway this changed nothing... Not surprising actually, since you never reference @pk. ---
**Author:** ![Jirka\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jirka_liska/32/117513_2.png) [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Post date:** [May 23, 2023, 4:34pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/5 "2023-05-23T16:34:19Z")
With or without I would expect to see this POST request in API logs but there is none..Is possible I'm doing something else wrong? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 23, 2023, 5:03pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/6 "2023-05-23T17:03:28Z")
What sets the [EOF] field to "EOF"? ---
**Author:** ![Jirka\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jirka_liska/32/117513_2.png) [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Post date:** [May 23, 2023, 5:19pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/7 "2023-05-23T17:19:43Z")
That's me, I'm adding it manually at the end of the file. I want to determine when parsing is done and notify my API with this info. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 23, 2023, 5:36pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/8 "2023-05-23T17:36:04Z")
But what sets the field? Did you mean `if [message] == "EOF"`? If so, you might need pipeline.ordered set to true (and pipeline.workers set to 1 as well). ---
**Author:** ![Jirka\_Liska](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jirka_liska/32/117513_2.png) [@Jirka\_Liska](https://discuss.elastic.co/u/Jirka_Liska)\ **Post date:** [May 23, 2023, 5:42pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/9 "2023-05-23T17:42:03Z")
Thank for your kind support! You're knowledge help fix my problem as always! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 20, 2023, 5:42pm UTC](https://discuss.elastic.co/t/ruby-api-call-when-parser-hit-specific-field/334107/10 "2023-06-20T17:42:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.