Ruby code to push whole map to event upon aggregate end_of_task

Elastic Stack Logstash
1

I understand with aggregate that push_map_as_event_on_timeout can be used to push the whole aggregated map to the event when there is a timeout, but that there is nothing like a push_map_as_event_on_end_of_task.

What would be the Ruby code I could use in my closing aggregate section (where end_of_task =>true) that would in one step push the entire map into the event? I have a variable set of map items I'll be aggregating, so enumerating them would be messy. I'm not strong with Ruby and the examples I've dug up so far are not quite getting me there.

Thanks in advance for your advice,
Kevin

2

I think enumeration is exactly what your need. I haven't tested it, but something like

map.each { |k,v|
    event.set(k, v)
}
3

Thank you so much for weighing in on this, Badger! I believe you nailed it perfectly.

Now in my closing aggregate section in Logstash which does not use a timeout but rather "end_of_task => true", I have this code line
code => "map.each {|k,v| event.set(k,v)}"

which is successfully carrying over all the aggregated map elements into the event just like **push_map_as_event_on_timeout **would do for a timeout-terminated aggregation section.

Again, thanks for your help!

Kevin Branch

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.