Ruby filter

I am not very familiar with ruby, more so how it interacts with logstash, but I am trying to parse an array of CSVs. For whatever reason the ruby filter I am trying to use is not expanding the variables as a valid field reference.

sample data

"rawkpidata" : [
            "node, memory,73%",
            "node, disk, 10%",
            "\"liadmf/0\", cpu, 3%",
            "\"rsrcmgr/0\", cpu, 0%",
            "\"lidf/0\", cpu, 0%",
            "\"apimgr/0\", cpu, 0%",
            "\"vnfctrl/0\", cpu, 3%",
            "\"dbmgr/0\", cpu, 0%",
            "\"hactrl/0\", cpu, 0%",
            "\"gtpctrl/0\", cpu, 30%",
            "\"ffemgr/0\", cpu, 0%",
            "\"crldl/0\", cpu, 13%",
            "\"ffe/0\", cpu, 0%",
            "\"mepmgr/0\", cpu, 73%",
            "\"connmgr/0\", cpu, 0%",
            "\"connmgr/1\", cpu, 0%",
            "\"sysstatslog/0\", cpu, 0%"


ruby {
      code => '
        if event.get("rawkpidata") == nil
          event.set("kpi", nil)
          kpis = event.get("[rawkpidata]")
          for kpi in kpis
            if kpi[0] 
              parentField = kpi[0].delete(" \"")
              childField = kpi[1].delete(" ")
              value = kpi[2].delete("%")
              fieldname = "\[#{parentField}\]\[#{childField}\]"

logstash log error

Ruby exception occurred: Invalid FieldReference: `[][l]`

Any pointers on how to get this to work properly would be very appreciated.

rawkpidata is an array of strings. For the second one ("node, memory,73%") you are creating a field [n][o] with value d. You need to split the string into an array. Add

kpi = kpi.split(/,\s*/)

at the start of your loop. Also, you do not need to escape the square brackets in fieldname.

Thanks, I previously had kpi.split(",") but, that didn't work either. I'll try your recommendation and see how it goes.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.