Ruby filter

Elastic Stack Logstash
1

I am not very familiar with ruby, more so how it interacts with logstash, but I am trying to parse an array of CSVs. For whatever reason the ruby filter I am trying to use is not expanding the variables as a valid field reference.

sample data

"rawkpidata" : [
            "",
            "node, memory,73%",
            "node, disk, 10%",
            "\"liadmf/0\", cpu, 3%",
            "\"rsrcmgr/0\", cpu, 0%",
            "\"lidf/0\", cpu, 0%",
            "\"apimgr/0\", cpu, 0%",
            "\"vnfctrl/0\", cpu, 3%",
            "\"dbmgr/0\", cpu, 0%",
            "\"hactrl/0\", cpu, 0%",
            "\"gtpctrl/0\", cpu, 30%",
            "\"ffemgr/0\", cpu, 0%",
            "\"crldl/0\", cpu, 13%",
            "\"ffe/0\", cpu, 0%",
            "\"mepmgr/0\", cpu, 73%",
            "\"connmgr/0\", cpu, 0%",
            "\"connmgr/1\", cpu, 0%",
            "\"sysstatslog/0\", cpu, 0%"
]

filter

ruby {
      code => '
        if event.get("rawkpidata") == nil
        
          event.set("kpi", nil)
          
        else
        
          kpis = event.get("[rawkpidata]")
          
          for kpi in kpis
                      
            if kpi[0] 
              parentField = kpi[0].delete(" \"")
              childField = kpi[1].delete(" ")
              value = kpi[2].delete("%")
            
            
              fieldname = "\[#{parentField}\]\[#{childField}\]"
              event.set(fieldname,value)
           end
            
          end
          
        end
      '
    }

logstash log error

Ruby exception occurred: Invalid FieldReference: `[][l]`

Any pointers on how to get this to work properly would be very appreciated.

2

rawkpidata is an array of strings. For the second one ("node, memory,73%") you are creating a field [n][o] with value d. You need to split the string into an array. Add

kpi = kpi.split(/,\s*/)

at the start of your loop. Also, you do not need to escape the square brackets in fieldname.

3

Thanks, I previously had kpi.split(",") but, that didn't work either. I'll try your recommendation and see how it goes.