Ruby filter

I am not very familiar with ruby, more so how it interacts with logstash, but I am trying to parse an array of CSVs. For whatever reason the ruby filter I am trying to use is not expanding the variables as a valid field reference.

sample data

"rawkpidata" : [
            "",
            "node, memory,73%",
            "node, disk, 10%",
            "\"liadmf/0\", cpu, 3%",
            "\"rsrcmgr/0\", cpu, 0%",
            "\"lidf/0\", cpu, 0%",
            "\"apimgr/0\", cpu, 0%",
            "\"vnfctrl/0\", cpu, 3%",
            "\"dbmgr/0\", cpu, 0%",
            "\"hactrl/0\", cpu, 0%",
            "\"gtpctrl/0\", cpu, 30%",
            "\"ffemgr/0\", cpu, 0%",
            "\"crldl/0\", cpu, 13%",
            "\"ffe/0\", cpu, 0%",
            "\"mepmgr/0\", cpu, 73%",
            "\"connmgr/0\", cpu, 0%",
            "\"connmgr/1\", cpu, 0%",
            "\"sysstatslog/0\", cpu, 0%"
]

filter

ruby {
      code => '
        if event.get("rawkpidata") == nil
        
          event.set("kpi", nil)
          
        else
        
          kpis = event.get("[rawkpidata]")
          
          for kpi in kpis
                      
            if kpi[0] 
              parentField = kpi[0].delete(" \"")
              childField = kpi[1].delete(" ")
              value = kpi[2].delete("%")
            
            
              fieldname = "\[#{parentField}\]\[#{childField}\]"
              event.set(fieldname,value)
           end
            
          end
          
        end
      '
    }

logstash log error

Ruby exception occurred: Invalid FieldReference: `[][l]`

Any pointers on how to get this to work properly would be very appreciated.

rawkpidata is an array of strings. For the second one ("node, memory,73%") you are creating a field [n][o] with value d. You need to split the string into an array. Add

kpi = kpi.split(/,\s*/)

at the start of your loop. Also, you do not need to escape the square brackets in fieldname.

Thanks, I previously had kpi.split(",") but, that didn't work either. I'll try your recommendation and see how it goes.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.