Ruby code for array iteration

Elastic Stack Logstash
1 
ruby {
        code => "
            event.get('db_user_details').each_index do |i|
                if [db_user_details][i][country] == "india"
                	event.set('flagger', 'done')
                end
            end
            "
        }
    }

here i want array iteration , is this correct

1 Like
2

No,

            if [db_user_details][i][country] == "india"

isn't valid Ruby (you need to use event.get()). Why use each_index in the first place? Try this

event.get('db_user_details').each do |item|
  if item['country'] == 'india'
    event.set('flagger', 'done')
  end
end
3 
[2018-06-26T19:57:15,132][FATAL][logstash.runner          ] The given configuration is invalid. Reason: Expected one of #, {, } at line 22, column 30 (byte 602) after filter {
  jdbc_streaming {
    jdbc_driver_library => "C:\Users\TCML\Desktop\keycloak - iac\postgresql-9.4-1202.jdbc4.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://localhost:5432/example"
    jdbc_user => "postgres"
    jdbc_password => "root"
    statement => "SELECT country from user_deatils"
    target => "db_user_details"
    cache_expiration => 1800
  }

        mutate{
                add_field => {"flagger" => "def"}
        }
        ruby {
        code => "
            event.get('db_user_details').each do |item|
                                if item['country'] == "
[2018-06-26T19:57:15,143][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException:

@magnusbaeck i am getting like this please help this

4

@magnusbaeck this is my configuration but i am getting error at the ruby code please help me

input {
  stdin{}
}
filter {
  jdbc_streaming {
    jdbc_driver_library => "C:\Users\TCML\Desktop\keycloak - iac\postgresql-9.4-1202.jdbc4.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://localhost:5432/example"
    jdbc_user => "postgres"
    jdbc_password => "root"
    statement => "SELECT country from user_deatils"
    target => "db_user_details"
    cache_expiration => 1800
  }

  	mutate{
		add_field => {"flagger" => "def"}
	}
	ruby {
        code => '
            event.get('db_user_details').each do |item|
  				if item['country'] == "india"
    				event.set('flagger', 'done')
  				end
			end
            '
        }
    }
}
output{
	stdout{ codec => rubydebug }
}
1 Like
5

Don't use double quotes inside a double-quoted string. I've updated my suggestion above.

6

thank you, but the field flagger is not updating

7

{
"message" => "\r",
"@timestamp" => 2018-06-26T14:55:15.552Z,

"flagger" => "def",

"@version" => "1",
"host" => "Eshwar",
"db_user_details" => [
[0] {
"country" => "india "
},
[1] {
"country" => "pakisatn "
},
[2] {
"country" => "india "
},
[3] {
"country" => "india "
}
]
}

where ever india is there it must have flagger for them

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.