Ruby filter loop through fields in logstash 5?

Elastic Stack Logstash
1

In logstash 2.1 I have been using a ruby filter to loop through all top-level fields and do a gsub to remove some special characters. I know that in 5.0, the Event API has changed significantly with an impact on ruby filters, namely the use of getters and setters instead of directly changing field values. My filter looked like this:

ruby {
    code => "
        event.to_hash.each { |k,v|
            v.gsub!('badcharacter', 'replacementChar') if v.is_a?(String)
        }
    "
}

The refactoring of the gsub should not be difficult. However, my filter does not specify what fields to replace, it acts on all fields. With the new Event API, is there still functionality like event.to_hash.each { |k,v| that would allow me to abstractly apply my gsub filter to all fields??

1 Like
2

[quote="Maxwell_Flanders, post:1, topic:72026"]
have been using a ruby filter to loop through all top-level fields and do a gsub to remove some special characters. I know that in 5.0, the Event API has changed significantly with an impact on ruby filters, namely the use of getters and setters instead of directly changing field values. My

+1 I have the same issue. Did you find a way to solve it ?

3

Isn't to_hash still available in the event object? Looking at the source code it appears to be.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.