Hi,
I'm recently having some issues with adjusting logstash ruby filter to logstash 5.0's event API.
here's my old conf file (with suspected lines):
filter
{
ruby
{
code => "
require 'json'
require 'digest/md5'
**message_hash = JSON.parse(event['message'])**
def flatten_hash(hash)
hash.each_with_object({}) do |(k, v), h|
if v.is_a? Hash
flatten_hash(v).map do |h_k, h_v|
h[%Q(#{k}_#{h_k}).to_sym] = h_v
end
else
h[k] = v
end
end
end
message_hash = flatten_hash(message_hash)
message_json = message_hash.to_json
**event['message'] = message_json.to_s**
**event['@metadata']['computed_id'] = Digest::MD5.hexdigest(event['message'])"**
}
which resulted the following error:
[ERROR][logstash.filters.ruby ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.
When applying the following changes :
filter
{
ruby
{
code => "
require 'json'
require 'digest/md5'
**message_hash = JSON.parse(event.get('message'))**
def flatten_hash(hash)
hash.each_with_object({}) do |(k, v), h|
if v.is_a? Hash
flatten_hash(v).map do |h_k, h_v|
h[%Q(#{k}_#{h_k}).to_sym] = h_v
end
else
h[k] = v
end
end
end
message_hash = flatten_hash(message_hash)
message_json = message_hash.to_json
**event.set('message', message_json.to_s)**
**event.set('[@metadata][computed_id]', Digest::MD5.hexdigest(event.get('message')))**
}
i get :
[ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, {, } at line 41, column 20
(byte 978) after filter\n{\n ruby\n {\n code => \"\n require 'json'\n require 'digest/md5'\n
message_hash = JSON.parse(event.get('message'))\n def flatten_hash(hash)\n
hash.each_with_object({}) do |(k, v), h|\n if v.is_a? Hash\n flatten_hash(v).map do |h_k, h_v|\n
h[%Q(\#{k}_\#{h_k}).to_sym] = h_v\n end\n else\n h[k] = v\n end\n end\n
end\n message_hash = flatten_hash(message_hash)\n message_json = message_hash.to_json\n
event.set('message', message_json.to_s)\n event.set('[@metadata][computed_id]',
Digest::MD5.hexdigest(event.get('message')))\n }\n\n json {\n source => \""}
it seems like I'm missing something syntax-wise. would most appreciate any help.
Thanks .
UPDATE:
it seems like i was missing " one the end of the ruby 'code'. still receiving the former error regarding the new API.