### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 16, 2019, 10:23pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/1 "2019-07-16T22:23:51Z")
I'm trying to take a pair of fields that contain a date and subtract one from the other. However, my code is wrong somewhere and i get an error. This error occurs three times for each event, so I assume it's a syntax error in all three ruby filters I use in this pipeline.
```auto
[ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `[]' for #`
```
Here's what i have in the pipeline.
```auto
##convert old.sys_updated date/time data type to epoch
ruby { code => "event['old.sys_updated_epoch'] = event['old.sys_updated_time'].to_i" }
#Convert current timestamp to epoch
ruby { code => "event['currenttime_epoch'] = event['sys_updated_on'].to_i" }
#Calculate difference between old.sys_updated_epoch and currenttime_epoch
ruby { code => "event['duration_epoch'] = event['currenttime_epoch'] - event['old.sys_updated_epoch']" }
```
Where is my code wrong at?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 16, 2019, 10:42pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/2 "2019-07-16T22:42:31Z")
Unless you are using a very old version you should be using the [event API](https://www.elastic.co/guide/en/logstash/current/event-api.html), so
```
ruby { code => "event.set('old.sys_updated_epoch') = event.get('old.sys_updated_time').to_i" }
```
In addition to the documented get and set methods, event has to\_hash and a sprintf method that can be used to resolve sprintf references.
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 17, 2019, 2:13pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/3 "2019-07-17T14:13:51Z")
Guess I should have mentioned that I am running Logstash 7.2.0. Unfortunately, that syntax threw an error.
```auto
[ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SyntaxError) (ruby filter code):2: syntax error, unexpected '='
event.set('currenttime_epoch') = event.get('sys_updated_on').to_i
```
When I change it to using square brackets, the following error is thrown for all three instances of the ruby filter I use.
```auto
ruby { code => "event.set['old.sys_updated_epoch'] = event.get['old.sys_updated_time'].to_i" }
```
```auto
[ERROR][logstash.filters.ruby] Ruby exception occurred: wrong number of arguments calling `set` (given 0, expected 2)
```
Giving another read of [this documentation](https://www.elastic.co/guide/en/logstash/current/event-api.html), I used the example at the very bottom to correct the syntax and get a functional line of code. Here's the working value.
```auto
ruby { code => 'event.set("old.sys_updated_epoch", event.get("old.sys_updated_time").to_i)' }
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 17, 2019, 2:17pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/4 "2019-07-17T14:17:10Z")
Sorry about that, I was so focused on changing the square brackets to API calls that I missed the other change required.
---
### Author:  [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 17, 2019, 2:19pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/5 "2019-07-17T14:19:40Z")
No worries, incorrect syntax is an easy miss, I do it CONSTANTLY.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 14, 2019, 2:19pm UTC](https://discuss.elastic.co/t/ruby-filter-syntax/190839/6 "2019-08-14T14:19:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.