Ruby exception undefined method `each'

[Elango-mas (Prince)]

i have to check the list of values h=[2,3,7,12] in below array

details { a= [1,2,3,4] , b=[5,6,7,8] , c=[9,10] , d=[11,12,13] }

and have to create a new array as below
details_new { a=[2,3] , b=[7], d=[12] }

I am using Ruby code to check

ruby {  code => '
        i =0
        cds = event.get("details")
            cds.each do |cnas|
                
                nodel = event.get("cnas")
                 nodel.each do |cnd|
                    
                    cnd=event.get("cnode")
                    if event.get(nodes).include?("cnd")
        				event.set("[new_cdetails][cds][i]","cnd")
        			end
                i +=1
            
                end
                
           end
        '
}

ButI getting this following error

[logstash.filters.ruby ] Ruby exception occurred: undefined methodeach' for nil:NilClass`

Please can I any suggestions on this issue.

Thanks in advance!
Elango

[guyboertje]

The Event get API call can return a nil, you need to check for this.

Is the details value a hash (JSON object)? If so, then you would have all the inner keys and values in the returned hash already.

Is this close to what you want?

input {
  generator {
    message => '{"details":{"a":[1,2,3],"b":[4,5,6],"c":[7,8,9]},"control":[2,3,6,7,8]}'
    count => 1
  }
}

filter {
  json {
    source => "message"
  }
  if "_jsonparsefailure" not in [tags]  {
    ruby {
      code => '
        details_hash = event.get("details")
        control_array = event.get("control")
        return if details_hash.nil? || control_array.nil?
        adjusted_details_hash = Hash.new
        details_hash.each do |key, detail_values|
          # use array intersection operator
          adjusted_details_hash[key] = control_array & detail_values
        end
        event.set("adjusted_details", adjusted_details_hash)
      '
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

Gives:

{
             "details" => {
        "a" => [
            [0] 1,
            [1] 2,
            [2] 3
        ],
        "b" => [
            [0] 4,
            [1] 5,
            [2] 6
        ],
        "c" => [
            [0] 7,
            [1] 8,
            [2] 9
        ]
    },
             "control" => [
        [0] 2,
        [1] 3,
        [2] 6,
        [3] 7,
        [4] 8
    ],
          "@timestamp" => 2018-12-07T10:32:40.093Z,
            "sequence" => 0,
    "adjusted_details" => {
        "a" => [
            [0] 2,
            [1] 3
        ],
        "b" => [
            [0] 6
        ],
        "c" => [
            [0] 7,
            [1] 8
        ]
    },
            "@version" => "1",
             "message" => "{\"details\":{\"a\":[1,2,3],\"b\":[4,5,6],\"c\":[7,8,9]},\"control\":[2,3,6,7,8]}",
                "host" => "Elastics-MacBook-Pro.local"
}

[guyboertje]

NOTE: in the code sample I gave, I use the generator input with a JSON encoded string and the json filter only for illustration to give me an event with a presumed structure. You can focus on the ruby filter bit - but experiment with the example code by changing he JSON to be what your event looks like and change the code literals to suit.

[Elango-mas (Prince)]

Thank you!