Ruby filter raises error on event.delete


(Steffen Winther Sørensen) #1

Got a ruby filter:

ruby { code => "
event.delete('message') if event['message'].empty?

$DROP_STATS = %w[unwantedstat1 unwantedstat2 unwantedstat3]
event.cancel if event['stat'] and $DROP_STATS.include?(event['stat'])
" }

only ruby complains like this:

Ruby exception occurred: undefined method `delete' for #LogStash::Event:0x4cf922cb {:level=>:error}

how can I remove a field from an event within ruby?


(Vincent Tran) #2

Try:

event.remove(field)

(Steffen Winther Sørensen) #3

ruby doc doesn't list remove as an operation of a hash, but delete(field), so...


(Vincent Tran) #4

The event object is Class: LogStash::Event, not technically a hash. Did you even try before commenting :smile:

http://www.rubydoc.info/gems/logstash-event/1.1.5/LogStash/Event#remove-instance_method


(Steffen Winther Sørensen) #5

Okay not as you write it's a class variable (will read the doc...) thanks!
I'm at it :wink:


(Steffen Winther Sørensen) #6

event.remove works :+1:


(Steffen Winther Sørensen) #7

That is it doesn't rise an exception/error anymore, but it seems it doesn't get called either due to my if expression as changing it to this shows expression never evaluates to true, any hints why not?

$DROP_STATS = %w[unwantedstat1 unwantedstat2 unwantedstat3]
if $DROP_STATS.include?(event['stat'])
    event['dropped_stat'] = 'found'
    event.cancel
end

(Steffen Winther Sørensen) #8

Forget my mistake (naturally :wink: code snippet IS working as expected, just didn't had it in the right execution path to get it triggered.


(system) #9