Ruby filter event API

Elastic Stack Logstash
1

Hi,
I'm recently having some issues with adjusting logstash ruby filter to logstash 5.0's event API.
here's my old conf file (with suspected lines):

filter
 {
ruby
{
    code => "
    require 'json'
    require 'digest/md5'
    **message_hash = JSON.parse(event['message'])**
    def flatten_hash(hash)
      hash.each_with_object({}) do |(k, v), h|
        if v.is_a? Hash
          flatten_hash(v).map do |h_k, h_v|
           h[%Q(#{k}_#{h_k}).to_sym] = h_v
         end
        else
          h[k] = v
       end
      end
    end
    message_hash = flatten_hash(message_hash)
    message_json = message_hash.to_json
    **event['message'] = message_json.to_s**
    **event['@metadata']['computed_id'] = Digest::MD5.hexdigest(event['message'])"**
}

which resulted the following error:

      [ERROR][logstash.filters.ruby    ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

When applying the following changes :

filter
{
ruby
{
    code => "
    require 'json'
    require 'digest/md5'
    **message_hash = JSON.parse(event.get('message'))**
    def flatten_hash(hash)
      hash.each_with_object({}) do |(k, v), h|
        if v.is_a? Hash
          flatten_hash(v).map do |h_k, h_v|
           h[%Q(#{k}_#{h_k}).to_sym] = h_v
         end
        else
          h[k] = v
       end
      end
    end
    message_hash = flatten_hash(message_hash)
    message_json = message_hash.to_json
    **event.set('message', message_json.to_s)**
    **event.set('[@metadata][computed_id]', Digest::MD5.hexdigest(event.get('message')))**
}

i get :

[ERROR][logstash.agent           ] Cannot create pipeline {:reason=>"Expected one of #, {, } at line 41, column 20
 (byte 978) after filter\n{\n    ruby\n    {\n        code => \"\n        require 'json'\n        require 'digest/md5'\n  
  message_hash = JSON.parse(event.get('message'))\n        def flatten_hash(hash)\n          
hash.each_with_object({}) do |(k, v), h|\n            if v.is_a? Hash\n              flatten_hash(v).map do |h_k, h_v|\n     
      h[%Q(\#{k}_\#{h_k}).to_sym] = h_v\n             end\n            else\n              h[k] = v\n           end\n          end\n    
end\n        message_hash = flatten_hash(message_hash)\n        message_json = message_hash.to_json\n   
 event.set('message', message_json.to_s)\n        event.set('[@metadata][computed_id]', 
Digest::MD5.hexdigest(event.get('message')))\n    }\n\n    json {\n        source => \""}

it seems like I'm missing something syntax-wise. would most appreciate any help.
Thanks .

UPDATE:
it seems like i was missing " one the end of the ruby 'code'. still receiving the former error regarding the new API.

2

Please show your current configuration and the exact error message.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.