# Ruby filter event API

**URL:** <https://discuss.elastic.co/t/ruby-filter-event-api/95081>\
**Category:** Logstash\
**Created:** [July 30, 2017, 4:25pm UTC](https://discuss.elastic.co/t/ruby-filter-event-api/95081 "2017-07-30T16:25:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dtko](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@dtko](https://discuss.elastic.co/u/dtko)\
**Post date:** [July 30, 2017, 4:25pm UTC](https://discuss.elastic.co/t/ruby-filter-event-api/95081/1 "2017-07-30T16:25:09Z")

</div>

Hi,  
I'm recently having some issues with adjusting logstash ruby filter to logstash 5.0's [event API](https://www.elastic.co/guide/en/logstash/current/breaking-changes.html).  
here's my old conf file (with suspected lines):

```
filter
 {
ruby
{
    code => "
    require 'json'
    require 'digest/md5'
    **message_hash = JSON.parse(event['message'])**
    def flatten_hash(hash)
      hash.each_with_object({}) do |(k, v), h|
        if v.is_a? Hash
          flatten_hash(v).map do |h_k, h_v|
           h[%Q(#{k}_#{h_k}).to_sym] = h_v
         end
        else
          h[k] = v
       end
      end
    end
    message_hash = flatten_hash(message_hash)
    message_json = message_hash.to_json
    **event['message'] = message_json.to_s**
    **event['@metadata']['computed_id'] = Digest::MD5.hexdigest(event['message'])"**
}

```

which resulted the following error:

```
      [ERROR][logstash.filters.ruby] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

```

When applying the following changes :

```
filter
{
ruby
{
    code => "
    require 'json'
    require 'digest/md5'
    **message_hash = JSON.parse(event.get('message'))**
    def flatten_hash(hash)
      hash.each_with_object({}) do |(k, v), h|
        if v.is_a? Hash
          flatten_hash(v).map do |h_k, h_v|
           h[%Q(#{k}_#{h_k}).to_sym] = h_v
         end
        else
          h[k] = v
       end
      end
    end
    message_hash = flatten_hash(message_hash)
    message_json = message_hash.to_json
    **event.set('message', message_json.to_s)**
    **event.set('[@metadata][computed_id]', Digest::MD5.hexdigest(event.get('message')))**
}

```

i get :

```
[ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, {, } at line 41, column 20
 (byte 978) after filter\n{\n ruby\n {\n code => \"\n require 'json'\n require 'digest/md5'\n  
  message_hash = JSON.parse(event.get('message'))\n def flatten_hash(hash)\n          
hash.each_with_object({}) do |(k, v), h|\n if v.is_a? Hash\n flatten_hash(v).map do |h_k, h_v|\n     
      h[%Q(\#{k}_\#{h_k}).to_sym] = h_v\n end\n else\n h[k] = v\n end\n end\n    
end\n message_hash = flatten_hash(message_hash)\n message_json = message_hash.to_json\n   
 event.set('message', message_json.to_s)\n event.set('[@metadata][computed_id]', 
Digest::MD5.hexdigest(event.get('message')))\n }\n\n json {\n source => \""}

```

it seems like I'm missing something syntax-wise. would most appreciate any help.  
Thanks .

UPDATE:  
it seems like i was missing " one the end of the ruby 'code'. still receiving the former error regarding the new API.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 2, 2017, 10:23am UTC](https://discuss.elastic.co/t/ruby-filter-event-api/95081/2 "2017-08-02T10:23:35Z")

</div>

Please show your current configuration and the exact error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2017, 10:23am UTC](https://discuss.elastic.co/t/ruby-filter-event-api/95081/3 "2017-08-30T10:23:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.