# Ruby Filter output to Field

**URL:** <https://discuss.elastic.co/t/ruby-filter-output-to-field/1876>\
**Category:** Logstash\
**Created:** [June 3, 2015, 9:40pm UTC](https://discuss.elastic.co/t/ruby-filter-output-to-field/1876 "2015-06-03T21:40:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jruybal](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@jruybal](https://discuss.elastic.co/u/jruybal)\
**Post date:** [June 3, 2015, 9:40pm UTC](https://discuss.elastic.co/t/ruby-filter-output-to-field/1876/1 "2015-06-03T21:40:55Z")

</div>

I'm testing a ruby filter to build a small list of hosts that are producing less than a certain number of events per minute.

Is there a standard method to get this output back into the event json?

Currently I'm trying with the following code. The first line generates the list of nodes, the second one should insert it into the message field.

```
count = event.select{ |key| key[/app\.count$/] }.select{ |key, value| value.to_s.to_i <= 8 }.to_s.gsub('events.', '').gsub('.count', '')
event['message'].insert(0, var) 

```

However this doesn't appear to be working. It's not required that the list goes into the message field. Really I just need to get it to logstash's output. Does anyone have any ideas?

I apologize ahead of time, I'm not very experienced with ruby. I appreciate any help.

---

<div class="post-metadata">

**Author:** ![rafaltrojniak](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@rafaltrojniak](https://discuss.elastic.co/u/rafaltrojniak)\
**Post date:** [June 4, 2015, 9:51pm UTC](https://discuss.elastic.co/t/ruby-filter-output-to-field/1876/2 "2015-06-04T21:51:19Z")

</div>

Can you provide example event that your script should work on ?

---

<div class="post-metadata">

**Author:** ![jruybal](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@jruybal](https://discuss.elastic.co/u/jruybal)\
**Post date:** [June 8, 2015, 5:58pm UTC](https://discuss.elastic.co/t/ruby-filter-output-to-field/1876/3 "2015-06-08T17:58:41Z")

</div>

I actually figured out part of what I was doing wrong. My conditional was incorrect so the logs were passing right over the filter.

Now however I get the new field created with brackets but no content.

Current ruby filter is

```
event['inactive'] = event.to_s.scan(/\w+\-app\.count...[0-4]?[0-9]/).to_s.gsub(/\.count/, ' ')

```

Below is an example event

```
  {
  "_index": "logstash-2015.06.02",
  "_type": "logs",
  "_id": "AU22Wu6WI9PjSCKuhHlk",
  "_score": null,
  "_source": {
    "@version": "1",
    "@timestamp": "2015-06-02T22:18:41.352Z",
    "message": "syslog",
    "events.esd1-qa2.count": 2,
    "events.esd1-qa2.rate_1m": 0.021746301622157297,
    "events.trello-qa2.count": 266,
    "events.trello-qa2.rate_1m": 2.9085596738152457,
    "events.pg1-qa2.count": 2,
    "events.pg1-qa2.rate_1m": 0.021746301622157297,
    "events.haproxy1-app.count": 1,
    "events.haproxy1-app.rate_1m": 0.010541994097562062,
    "events.trello-app.count": 6,
    "events.trello-app.rate_1m": 0.07707065958795782,
    "events.cc4-app.count": 49,
    "events.cc4-app.rate_1m": 1.043409992451638,
    "events.cc2-qa2.count": 940,
    "events.cc2-qa2.rate_1m": 17.067786217080286,
    "events.pg2-qa2.count": 2,
    "events.pg2-qa2.rate_1m": 0.010541994097562062,
    "events.jira-app.count": 8,
    "events.jira-app.rate_1m": 0.10276087945061044,
    "events.office365-qa1.count": 214,
    "events.office365-qa1.rate_1m": 14.321784645741761,
    "events.cc4-qa2.count": 916,
    "events.cc4-qa2.rate_1m": 20.449810405258265,
    "events.cc3-qa2.count": 899,
    "events.cc3-qa2.rate_1m": 9.76185652915327,
    "events.haproxy1-qa2.count": 6,
    "events.haproxy1-qa2.rate_1m": 0.07157574646541,
    "events.esd1-qa1.count": 8,
    "events.esd1-qa1.rate_1m": 0.09017685087937428,
    "tags": [
      "metric",
      "syslog-overflow"
    ]
  }
}

```

Output is

```
"inactive': []
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/ruby-filter-output-to-field/1876/4 "2017-07-06T05:38:10Z")

</div>