Ruby code to split array message and get the index and value in logstash


(Aditya Srivastava) #1

I am new to ruby code. Will appreciate any help on this.

my input is
message => field id="0" value="01"/>\n field id="3" value="03"/>\n <field
id="5" value="05"/>\n field id="7" value="07"/>\n <field id="9"
value="09"/>\n /isomsg>\n"

I have applied kv filter here

kv {
source => "message"
trim => """
trimkey => """
field_split => " "
value_split => "="
}

The output I receive is
"id" => [
[0] "0",
[1] "3",
[2] "5",
[3] "7",
[4] "9"
],
"value" => [
[0] "01",
[1] "03",
[2] "05",
[3] "07",
[4] "09"
],

Now I want to write a ruby code where I can extract the id and value wrt to index

The ruby code should be in loop and check , if id[index] == "7"
event['thisvalue'] = value[index]

Means first find the index where id is 7(say indexA = 3) and then extract the value at indexA(which should be 07) and store this value as a field.

For this, the code i wrote is

ruby {
code => "
times = event['id'].split(',')
times.each_index { |i| event[i.to_s] = times[i]
if times[i] == "7"
event['IndexValue'] = i}
"
}
This code should at-least give me index where the value for "id" is 7 which is not happening and I get ruby fail exception as a tag.

"tags" => [
[0] "_rubyexception"
],

Please some one help me with the ruby code part.
Also Please provide me with some link where I can learn atleast the basic concepts of ruby(this use case is just the beginning for me)


(Magnus B├Ąck) #2

Please don't start multiple threads asking the same thing.


(Aditya Srivastava) #3

Ya sure.My mistake.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.