# Ruby filter in logstash

**URL:** https://discuss.elastic.co/t/ruby-filter-in-logstash/134404
**Category:** Logstash
**Created:** [June 4, 2018, 10:50am UTC](https://discuss.elastic.co/t/ruby-filter-in-logstash/134404 "2018-06-04T10:50:57Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Shivom\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Shivom\_Kumar](https://discuss.elastic.co/u/Shivom_Kumar)
#### Post date: [June 4, 2018, 10:50am UTC](https://discuss.elastic.co/t/ruby-filter-in-logstash/134404/1 "2018-06-04T10:50:58Z")

</div>

i have my log something like this :  
May 23 2018 06:32:47 GMT: INFO (xdr): (xdr.c:607) [030]: dc-state CLUSTER\_UP timelag-sec 0 lst 1527057166864 mlst 1527057166864 (2018-05-23 06:32:46 GMT) fnlst 0 (-) wslst 0 (-) shlat-ms 1 rsas-ms 0.000 rsas-pct 0.0 con 384 errcl 502 errsrv 1182 sz 6

i parsed it using grok filter and i have something called list\_field value.  
list\_field\_value = dc-state CLUSTER\_UP timelag-sec 0 lst 1527057166864 mlst 1527057166864 (2018-05-23 06:32:46 GMT) fnlst 0 (-) wslst 0 (-) shlat-ms 1 rsas-ms 0.000 rsas-pct 0.0 con 384 errcl 502 errsrv 1182 sz 6  
it is a combination of field and value.  
here dc-state is a field and CLUSTER-UP is its respective value and so on.  
now i am using ruby filter in logstash to split list\_field\_value into two arrays: one category fieds and other category\_field\_values.  
now i want to ignore two types of values while spiltting : one is (2018-05-23 06:32:46 GMT) like timstasmp and other is (-).  
i tried splitting on the basis of \s but then these two fields are also coming and timestamp is breaking and getting splitted and some part of it is coming in category\_field and somepart in category\_field\_values. i defined a regex for the above timestamp and put it under split but its not working.  
here is my ruby code  
ruby {  
code =\> '  
i = 1  
category\_fields = []  
category\_fields\_values = []

```
            a = event.get("list_field_value").split((/\(%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}:?%{SECOND}\s*[G][M][T]\)|\(-\)|\s)/).each { |v|
                i = i+1
                if i % 2 == 0
                    	category_fields << v
                else
                    category_fields_values << v
                end
            }

```

}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2018, 10:50am UTC](https://discuss.elastic.co/t/ruby-filter-in-logstash/134404/2 "2018-07-02T10:50:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.