Ruby filter: escaping single quote inside the back quote expression

Elastic Stack Logstash
1

I am trying to run a powershell command to get the system date. In a windows command line you type this:

powershell -command (date).ToString('yyyyMMddhhmmss')

It outputs the current time in the required format. However stashing this into ruby code filter after escaping the single-quote causes error.

ruby {
		code => 'event.set("ctime", `powershell -command (date).ToString(\'yyyyMMddhhss\')`)'
	}

I get the following error:

logstash
logstash1033×470 28.8 KB

2

I guess this is a problem with ruby version used by jruby (as of v7.6.1)

However, the following workaround might help:

  • Make a script (powershell as in this case) to output the system time in the required format
  • Utilize script from within the ruby filter
ruby {
		code => 'event.set("ctime", `powershell d:/code/ps1/misc/time.ps1`)'
	}