Ruby request and logstash

Hi,

I'm trying to make a ruby request to elastic search using Logstash and ruby.
this is my filter part in the config file.

filter {
       
json {
              source => "message"
           }
         }

     ruby {
                   init => "
                                require 'net/http'
                                require 'net/https'
                                require 'uri'
                                require 'json'
                        "
                   code => "
                             puts  uri = URI('https://xxx.xxx.xx.xxx:9200/index/doc/_search')
        
                                Net::HTTP.start(uri.host, uri.port,
                                  :use_ssl => uri.scheme == 'https', 
                                  :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|

                                  request = Net::HTTP::Get.new uri.request_uri
                                  request.Content-Type = 'application/json'
                                  request.basic_auth 'user', 'password'
                                  request.body = '{\n  \"query\": {\n    \"term\": {\n  \"Carriles.keyword\": \"DAI-CAI LOPEZMESA-P1-L0\"\n }\n }\n}'
                                  response = http.request request # Net::HTTPResponse object
                                  puts response.body
                                                                 
                               end
        
                     

                             "
                 

                }
                mutate { remove_field => ["message"] }
}

I need the response from the query to elastic. But I only get this message from ruby and I don't now what is wrong.

[ERROR] 2019-08-23 12:27:45.985 [Ruby-0-Thread-4: :1] ruby - Ruby exception occurred: end of file reached

Not sure what the exception means, but you do know there is an elasticsearch filter you can use, right?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.