Ruby filter raises error on event.delete

Elastic Stack Logstash
1

Got a ruby filter:

ruby { code => "
event.delete('message') if event['message'].empty?

$DROP_STATS = %w[unwantedstat1 unwantedstat2 unwantedstat3]
event.cancel if event['stat'] and $DROP_STATS.include?(event['stat'])
" }

only ruby complains like this:

Ruby exception occurred: undefined method `delete' for #LogStash::Event:0x4cf922cb {:level=>:error}

how can I remove a field from an event within ruby?

2

Try:

event.remove(field)
3

ruby doc doesn't list remove as an operation of a hash, but delete(field), so...

4

The event object is Class: LogStash::Event, not technically a hash. Did you even try before commenting :smile:

http://www.rubydoc.info/gems/logstash-event/1.1.5/LogStash/Event#remove-instance_method

5

Okay not as you write it's a class variable (will read the doc...) thanks!
I'm at it :wink:

6

event.remove works :+1:

7

That is it doesn't rise an exception/error anymore, but it seems it doesn't get called either due to my if expression as changing it to this shows expression never evaluates to true, any hints why not?

$DROP_STATS = %w[unwantedstat1 unwantedstat2 unwantedstat3]
if $DROP_STATS.include?(event['stat'])
    event['dropped_stat'] = 'found'
    event.cancel
end
8

Forget my mistake (naturally :wink: code snippet IS working as expected, just didn't had it in the right execution path to get it triggered.