I am not very familiar with ruby, more so how it interacts with logstash, but I am trying to parse an array of CSVs. For whatever reason the ruby filter I am trying to use is not expanding the variables as a valid field reference.
sample data
"rawkpidata" : [
"",
"node, memory,73%",
"node, disk, 10%",
"\"liadmf/0\", cpu, 3%",
"\"rsrcmgr/0\", cpu, 0%",
"\"lidf/0\", cpu, 0%",
"\"apimgr/0\", cpu, 0%",
"\"vnfctrl/0\", cpu, 3%",
"\"dbmgr/0\", cpu, 0%",
"\"hactrl/0\", cpu, 0%",
"\"gtpctrl/0\", cpu, 30%",
"\"ffemgr/0\", cpu, 0%",
"\"crldl/0\", cpu, 13%",
"\"ffe/0\", cpu, 0%",
"\"mepmgr/0\", cpu, 73%",
"\"connmgr/0\", cpu, 0%",
"\"connmgr/1\", cpu, 0%",
"\"sysstatslog/0\", cpu, 0%"
]
filter
ruby {
code => '
if event.get("rawkpidata") == nil
event.set("kpi", nil)
else
kpis = event.get("[rawkpidata]")
for kpi in kpis
if kpi[0]
parentField = kpi[0].delete(" \"")
childField = kpi[1].delete(" ")
value = kpi[2].delete("%")
fieldname = "\[#{parentField}\]\[#{childField}\]"
event.set(fieldname,value)
end
end
end
'
}
logstash log error
Ruby exception occurred: Invalid FieldReference: `[][l]`
Any pointers on how to get this to work properly would be very appreciated.