Hi
I'm trying to do this:
if [directive] {
ruby {
code =>
"if event['directive'] <=30
event[scenario] = 'scenario_one'
end
"
}
}
Basically if the directive field exists (which I have already converted to an integer) then I want to test its value against several conditionals then depending on where the value falls I need to add a new field "scenario" with the scenario name Eg "scenario_one".
Can't seem to get Logstash to co-operate as it is complaining about undefined field "scenario".
I would appreciate any advice. Thanks.
SOLVED
I forgot to wrap the new field name in single quotes!!
This worked:
event['scenario'] = 'scenario_one'
Awesome... the ruby filter is so powerful!