# Ruby Code in Logstash to extract specific line

**URL:** <https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385>\
**Category:** Logstash\
**Created:** [April 23, 2020, 5:57am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385 "2020-04-23T05:57:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [April 23, 2020, 5:57am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/1 "2020-04-23T05:57:55Z")

</div>

Hello,

I have a java stack error message and I would like to extract "Caused by" line from the full error message.

I had followed the instructions stated in the below post :

> [@Extract](https://discuss.elastic.co/t/extract/126754):
>
> Hi I would like to build a new field from my error messages using some grok patterns, the idea is to extract the class name from the first line and then from each single line that starts with "Caused by:" In the example below, the value of my new field should be: java.lang.RuntimeException/java.lang.IllegalStateException/java.lang.UnsupportedOperationException Exception in thread "main" java.lang.RuntimeException: error message at Exceptions.main(Exceptions.java:4) at sun.reflect.Nati…

I was able to achieve the results but with a minor issue :

The line that I want to print is :

java.lang.ClassCastException: weblogic.jms.common.DestinationImpl cannot be cast to javax.jms.ConnectionFactory

However the line being extracted is :

java.lang.ClassCastException

I know something needs to be changed in the below code. But I have no knowledge on ruby...Suggestions please...

The ruby code used is :

ruby {  
code =\> "  
s = event.get('logmessage')  
r = s.scan(/Caused By: ([^:]+):/)  
r = r.flatten  
event.set('causedby', r.join('/'))  
"  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 23, 2020, 4:38pm UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/2 "2020-04-23T16:38:26Z")

</div>

> [@vikramaddagulla](#):
>
> s.scan(/Caused By: ([^:]+):/)

That searches for "Caused By" followed by a colon and a space, then captures one or more characters that are not a colon. Since java.lang.ClassCastException is followed by a colon that is where it stops. You have not shown us what the logmessage field looks like so we cannot tell what should replace the ([^:]+): It might be ([^\n]+) or it might be (.\*)$

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [April 24, 2020, 5:15am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/3 "2020-04-24T05:15:17Z")

</div>

Hello

My log stack will look like the below ;

```
at weblogic.work.LivePartitionUtility.doRunWorkUnderContext(LivePartitionUtility.java:54)
at weblogic.work.PartitionUtility.runWorkUnderContext(PartitionUtility.java:41)
at weblogic.work.SelfTuningWorkManagerImpl.runWorkUnderContext(SelfTuningWorkManagerImpl.java:617)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:397)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:346)

```

Caused by: java.sql.SQLException: ORA-24776: cannot start a new transaction

```
at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:466)
at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:399)
at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:391)
at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:1126)
at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:546)
at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:269)

```

I would like to extract :  
java.sql.SQLException: ORA-24776: cannot start a new transaction

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [April 24, 2020, 5:28am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/4 "2020-04-24T05:28:26Z")

</div>

Please suggest if this is correct ?

Caused by: ([^\n]+)

Also, please suggest how can I make Caused By case insensitive ?

Because I observed that the log sometimes writes as Caused By and sometimes as Caused by

---

<div class="post-metadata">

**Author:** ![vikramaddagulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikramaddagulla/32/139858_2.png) [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Post date:** [April 24, 2020, 5:47am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/5 "2020-04-24T05:47:03Z")

</div>

I have used [https://rubular.com/](https://rubular.com/) and came up with the below expression :

r = s.scan(/Caused [bB]y: ([^\n]+)/)

I think this will work. I will test this and confirm.

Please suggest if any changes needed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2020, 5:47am UTC](https://discuss.elastic.co/t/ruby-code-in-logstash-to-extract-specific-line/229385/6 "2020-05-22T05:47:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.