Ruby Filter Logstash

Elastic Stack Logstash
1

Hi -
We are having the a field (xml.Terminal) in Elastic Search as:

{
"Value": [
{
"DimSize": [
"45"
],
"Value": [
"WindGen---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - WindGenerator.vi",
"SWTCC Power Adder---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Math\Math_Add.vi",
"SWTCC 1 Precharge model---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Converter precharge.vi",
"SWTCC 2 Precharge model---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Converter precharge.vi",
"LMU---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - LMU.vi",
"Converter cooling - CV1---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Cooling.vi",
"Converter cooling - CV2---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Cooling.vi",
"Grease---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Grease.vi",
"HydraulicAccPressure---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - HydraulicStation.vi",
"HydraulicAccBreakPressure---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - HydraulicAccBreakPressure.vi",
"PitchSysA---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBlade.vi",
"PitchSysB---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBlade.vi",
"PitchSysC---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBlade.vi",
"YawSys---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - YawSystem.vi",
"PMG Breaker SWTCC 1---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PMG breaker.vi",
"PMG Breaker SWTCC 2---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PMG breaker.vi",
"Hub24VSupply---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Hub24VSupply.vi",
"RPM---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - RPM.vi",
"TLC---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - TLC.vi",
"G Sensor---NoTag---C:\git\THS_Modules\Source\ModulesSICS\GSensor\D8_GSensorInterface.vi",
"MTS Sensor---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\HWInterface\HubMTS\MTSSensorInterface.vi",
"FPGA SWTCC 2 Interface---git# THS209.x.x.x---C:\git\THS_Modules\Source\ModulesSICS\SWTCC\SWTCCInterface.vi",
"FPGA SWTCC 1 Interface---git# THS209.x.x.x---C:\git\THS_Modules\Source\ModulesSICS\SWTCC\SWTCCInterface.vi",
"3Phase_GRID_Gen---NoTag---C:\git\THS_Modules\Source\ModulesSICS\Grid\D8_Grid.vi",
"Proportional Valves FB---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\HWInterface\HubMTS\PropValveFBInterface.vi",
"RotorModel---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - Rotor.vi",
"FT Sonic Sensor---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\HWInterface\SonicSensor\SonicSensor - Main.vi",
"FT Sonic Sensor 2---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\HWInterface\SonicSensor\SonicSensor - Main.vi",
"WindOffset---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\WindOffset.vi",
"SRSG---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - SRSG.vi",
"NacelleCooling---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - NacelleCooling.vi",
"SineTemp---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Math\Math_Sine.vi",
"HubSafeValve AND---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Math\Math_AND.vi",
"GeneratorGreaseExraction---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - GeneratorGreaseExtraction.vi",
"HeatElements---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - HeatElementsCurrent.vi",
"GeneratorHumidity---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - GeneratorHumidity.vi",
"YawEncoder---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\HWInterface\SIMBAInterface\SIMBA - EncoderInterfaceNEWACLV7_9 - SimbaAPI.vi",
"Fan Power Supply---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Math\Math_1to1Bridge.vi",
"PitchHydraulicBladeA---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBladeHydraulic.vi",
"PitchHydraulicBladeB---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBladeHydraulic.vi",
"PitchHydraulicBladeC---git# THS209.x.x.x---C:\git\THS_Modules\Source\Modules\Simulation\Simulation - PitchBladeHydraulic.vi"
],
"Name": [
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision",
"ModuleRevision"
]
}
],
"Name": [
"ModuleRevisions"
]
}

I would like to use Ruby Filter and iterate thru the elements; (event.get('[xml][Terminal][Value][0][Value]'))
which will return an array of values, and would like to save it as a separate fields in the ES.

Could someone please help.

2

I have tried with the below filters, but it throws ruby exception. Could you please check.

filter {
xml {
source => "message"
store_xml => "true"
target => "xml"
}

ruby {
code => "
data = event.get('[xml][Terminal]')
arr = data['Value'][0]['Value']
arr.each_with_index { |index, val|
event.set(index, val) }
"

}
}

3

@magnusbaeck - Could you please help me out here. Thanks !

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.