Ruby filter condition

Elastic Stack Logstash
1

Hi

I having a data like
status,id
0,A
2,B
3,C
A,D
B,E
6,N
Based on status value need to add one more field and insert good,bad in new field
if status is even number then new field value is good else status is alphabet and odd number than new field value is bad

Expected output
status,id,New_satus
0,A,Good
2,B,Good
3,C,Bad
A,D,Bad
B,E,Bad
6,N,Good

Used this code in filter(using logstash 5.0)
ruby {
code => "if event.get('status') % 2 ==0 event.set('STATUS', "Good") else event.set('STATUS', "Bad")"
}
But not able to fulfill can u guys please help on this is this possible

And can you please provide me the ruby filter reference doc link for further use.

Thanks

2

The status field is obviously a string field so you can't just use % on it. You have to convert it to an integer first, but that conversion will of course fail if the field doesn't contain an integer so you'd have to deal with that. If the number is always a single digit then things get very easy:

event.set('status', ["0", "2", "4", "6", "8"].include?(event.get('status')) ? "good" : "bad")

And can you please provide me the ruby filter reference doc link for further use.

Documentation of all Logstash filters is available from https://www.elastic.co.

3

Hi

Thanks for your swift reply but i will have more than one digit some times so done like

grok{
           match => { "status" => "%{INT:num}"} 
              }

           mutate{
	       convert => {"num" => "integer" }
	             }
    
	       ruby {
	       code => 'event.get("num") % 2 == 0 ? event.set("STATUS", "Good") : event.set("STATUS", "Bad")'
                }
	
              #failure when it is alphabet then can make as bad
	       if   "_grokparsefailure" in [tags]{
	       mutate{
	       add_field => { "STATUS" => "Bad" }
	             }

About ruby filter i didn't see much in elastic documentation can you share me the link where can i find it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.