Hey,
so I have this logstash conf-file with a part of ruby code in it that I mainly got though the help from one of you guys (managed to add one thing myself).
ruby {
code => '
e = event.get("[@metadata][theXML][Event][EventData][Data]")
if e.nil?
puts "empty"
elsif e.kind_of?(Array)
e.each { |x|
event.set(x["Name"], x["content"])
}
else
event.set(e["Name"], e["content"])
end
'
}
I need it to work with this EventData part of an xml-File containing Log-Events, kinda looks like that (simplified):
<xmldata>
<Event>
...
<EventData>
<Data Name="API">Plugin initialize</Data>
<Data Name="Result">3221521586</Data>
</EventData>
</Event>
</xmldata>
And it works fine if the EventData part looks like this, also if it's completely empty or if there's only one Data-thing in there ( works fine here means I get an output looking like "API" => Plugin initialize; "Result" => ...).
But I get a ruby_exception (no implicit conversion of nil into String) as soon as it looks like this:
<EventData>
<Data><string>LOG: Autovacuum-Launcher startet
</string>
</Data>
</EventData>
So when there are no subfields I guess, just one field called Data. I hoped I could just put another elsif-condition in there, but I don't know how to phrase the condition in this case.
Unfortunately I don't know anything about ruby really, so really glad about any form of help here.