Ruby code in logstash

I want to fetch the column name in ruby...
for example mrp = Rs.23
brand = Apple
Above is my mysql database....
So I am using event.get(mrp) and getting value.
But I also want mrp as a name. So how can I get. And idea about this....

Perhaps it'll be easier to understand if you give an example. What do you currently have? What do you want to get instead?

Sir,

filter {

filter {
ruby {
code => '
event.set("string_facet", [{"brandnew" => event.get("brandnew"), "brand" => event.get("brand")}, {"pricenew" => event.get("pricenew"), "price" => event.get("price")}])
'
}

}

mutate {
remove_field => ["brand", "price"]

}
mysql db example:
brandnew brand pricenew price
apple nokia 500 300

so as in the above code I am getting column value from event.get(brandnew). So value of column brandnew store in brandnew field. But how I can get column name itself.

You mean you're doing SELECT * FROM tablename so you don't know the names of the fields you'll get, but you still want to move them all into being subfields of string_facet?

No Sir, I keeping field name is event.get("brandnew") like and getting value of field and my answer getting after index like this...

"string_facet": [
{
"brand": "DOROTHY PERKINS",
"mrp": 2790
},
{
"price": 2232,
"pid": "2096456"
}
],

I got .mrp: 2790 ....like this code....event.get(mrp) and storing result in "mrp"...full code is
"mrp" => event.get(mrp)...where mrp is field...
Now I want to store the column name which is "mrp" in facet_name variable...how I can store...because I know only how to get values of fields ...not know how to assign column name....

I think sir now you understand what is my problem...
Thanks in advance.

Now I want to store the column name which is "mrp" in facet_name variable...how I can store...because I know only how to get values of fields ...not know how to assign column name....

So you want to end up with this?

"string_facet": [
{
"facet_name": "mrp",
"brand": "DOROTHY PERKINS",
"mrp": 2790
},
{
"facet_name": "pid",
"price": 2232,
"pid": "2096456"
}
],

or what? If yes, just include the facet_name key and value in the hash you're passing to event.set.

event.set(
    "string_facet", 
    [
        {"brandnew" => event.get("brandnew"), "brand" => event.get("brand"), "facet_name" => "brandnew"},
        {"pricenew" => event.get("pricenew"), "price" => event.get("price"), "facet_name" => "pricenew"}
    ]
)

Sir, I try the same way as you replied before...but problem is that when we write two times same key like facet_name it is not giving any result...but when I am changing the key name like facet_name1 and facet_name2...it is shwing result....

like this code will not show any index bcz of same key name

filter {
ruby {
code => '
event.set("string_facet", [{"facet_name" => "brand", "facet_value" => event.get("brand")}, {"facet_name" => event.get("price"), "facet_value" =>

event.get("price")}])
'
}

I need same thing as you replied sir. So I am not able to write same key name but I need same key.

because I want to create like this...
"string_facet": [
{
"facet-name": "manufacturer",
"facet-value": "Fortis"
},
{
"facet-name": "hammer_weight",
"facet-value": "1000"
}
],
Sir, your quick reply...will be solved my problem....Thanks in Sir.

like this code will not show any index bcz of same key name

That code looks fine. Is Logstash failing to post the event to Elasticsearch, or what are you saying? The Logstash and/or Elasticsearch logs will contain clues. But until you've debugged your inputs and filters you shouldn't be using an elasticsearch output in the first place. Always start with a stdout { codec => rubydebug } output and add the elasticsearch output when things look okay.

Yes, Now it is giving facet_name as you told...

But sir one more help...I need I also want value will store in facet_value field....but when I try like this..no output..

filter {
ruby {
code => '
{"brandnew" => event.get("brandnew"), "facet_value" => event.get("brand"), "facet_name" => "brandnew"},
{"pricenew" => event.get("pricenew"), "facet_value" => event.get("price"), "facet_name" => "pricenew"}
'
}

But when I removed facet_value....string it is giving output ....how can I store same like facet_name ..
bcz I want this type output..

"string_facet": [
{
"facet-name": "manufacturer",
"facet-value": "Fortis"
},
{
"facet-name": "hammer_weight",
"facet-value": "1000"
}
],

facet_name problem is solved sir. Only facet_value is problem.Sir can you suggest me code like u mention above.
for facet_value..
{"brandnew" => event.get("brandnew"), "brandvalue" => event.get("brand"), "facet_name" => "brandnew","facet_value" => "brandvalue"},

but it showing no output and also I mention stdout{
codec => rubudebug
}

my config...is like this..

filter {
ruby {
code => '
{"brandnew" => event.get("brandnew"), "facet_value" => event.get("brand"), "facet_name" => "brandnew"},
{"pricenew" => event.get("pricenew"), "facet_value" => event.get("price"), "facet_name" => "pricenew"}
'
}
mutate {
remove_field => ["brand", "price"]
}
}
output {

stdout{
codec => rubydebug
}
elasticsearch {
action => "index"
hosts => ["localhost:9200"]
index => "testflip23"
document_type => "tableindex"
document_id => "%{id}"
}

}
Thanks in advance.

Please do as I ask and remove the elasticsearch output.

Sir, you can see in this attached image while indexing...here you can see ruby code successfully converted as per desired string in facet_name and facet_value form but indexing not showing result...

Indec not done ..bcz I checked the size of this index which is same like 810b....when I changed the key value of facet_value to some other name then elastic start index...and then size of index also increase...why elastic not doing index of same key facet_value even it is doing index of facet_name.

Thanks in advance.

Last chance: Remove the elasticsearch output and focus on what you get from a stdout output.

Thanks Sir. You are awesome. You teach me how to solve problem...error was data type...I am right sir. I corrected the error. Now getting what ever I want. Thanks sir.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.