Ruby Script Adds a New Field to LS Data Record?

Elastic Stack Logstash
1

Hi Logstash Jedi Masters :slight_smile:

I need an example of a Ruby script which:

  1. Accepts a data record from Logstash
  2. Adds a new field to the record (e.g. : [ “NewField” ] )
  3. Fills in a default value (e.g. : [ “NewField” ] = “abc123” )
  4. Returns the record back to Logstash

I’ve been Googling this for an hour or so, but just can’t begin to guess at the syntax here. The syntax for creating the field and then accessing it really confuses me. Can anyone throw me a line? Thank you!

2

I would do this using mutate+add_field rather than ruby, but if you need to:

ruby { code => 'event.set("NewField", "abc123")' }
3

Thanks Badger,

Dumb follow-up question... When I look at my data records flowing through LS, I realize that I need new fields added, and I don't think I can code my LS filter {} section with the logic necessary to populate the data for those new fields. This is why I'm interested in LS passing all records off to an external Ruby script, and make Ruby do the hard work of modifying the records.

Is manipulating and modifying a LS data record beyond the capability of a Ruby script?

Would a better approach be for LS to hand Ruby a subset of the record's data, let Ruby do the fancy computations, wait for Ruby to return values, then let LS filter {} do a mutate + add_field to finish the job? Thank you!

4

No. A logstash ruby filter can contain almost any ruby code you can write. I do not see a reason to use an external script (in the sense of a separate process). The ruby code can get and set fields using the event API.

5

THanks Badger, this is what I was hoping for. Much appreciated. THis is the best tech forum... :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.