Ruby filter error

Elastic Stack Logstash
1

Dear Elastic Forum,

I am trying to understand how the ruby filter works in order to apply a complicated reindexing of some data in my cluster.
I wrote a simple ruby filter example which doesn't work:

input {
      elasticsearch {
        hosts => [
            "my-test-cluser.node.it"
        ]
        index => "index-*"
        query => '{ "query": { "match": { "_id": "yQmB_HABNyEH-HqOD0uw" } } }'
        codec => "json"
    }
}
filter {
    ruby {
        code => "test = event['@timestamp']"
    }
}

output {
    stdout { codec => rubydebug }
}

This simple example doesn't work and the error is:

[ERROR] 2020-03-26 23:48:54.385 [[colpi-reindex]>worker7] ruby - Ruby exception occurred: undefined method '[ ]' for #<LogStash::Event:0x71f2a29>

I can't really understand the error.

The output anyway is:

{
             "@version" => "1",
       "estensimetro_0" => -2,
        "colpiPerPezzo" => 3,
       "estensimetro_2" => 1,
    "maxForzaColonna_3" => 0,
               "encPos" => 357.8906,
            "exception" => "",
             "facility" => "local1",
           "@timestamp" => 2020-03-21T09:47:50.197Z,
           "sysloghost" => "datalog01.myserver.it",
        "consumoMotore" => 150,
               "logger" => "",
       "estensimetro_1" => 0,
              "evFreno" => false,
    "maxForzaColonna_1" => 368,
                 "tags" => [
        [0] "colpo",
        [1] "_rubyexception"
    ],
       "estensimetro_3" => 0,
              "appname" => "csvconverter",
    "maxForzaColonna_0" => 305,
             "severity" => "EMERG",
                 "type" => "Colpo",
                 "host" => "127.0.0.1:33456",
          "maxForzaTot" => 1452,
           "colpoPezzo" => 3,
              "colpoID" => 1584784069000,
           "evFrizione" => false,
    "maxForzaColonna_2" => 416
}

Thanks,
S.

2

Referring to the event as a hash was disabled years ago. Use the event API.

3

Thanks!!!
All the old examples I found on internet drove me in the wrong direction.

Regards,
S.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.