Ruby script and boolean

Elastic Stack Logstash
1

Hi there,

I have a question about the ruby filter.

I am getting logs in Json they are working quite good, but ofcourse I have inconsistence in the mapping. Usually the logs arrive with the fields

arg0, arg1, arg,2

They are objects most of the times. But sometimes they are not objects so I have created a small ruby script to change the field names if they are not objects:

 ruby {
    code => "
      fields = ['arg0', 'arg1', 'arg2', 'arg3', 'arg4', 'arg5']
      fields.each do |field|
        if event.get(field) and event.get(field).class != Hash
          event.set(field, {'original_value' => event.get(field)})
        end
      end
    "
    }

This works quite well, but I have seen that this does not include booleans.

So when "arg0": false, "arg1": true this ruby script does not work and the documents won´t be indexed because of a concrete value. I did not find a boolean class. Can anybody suggest something else I can do, except telling the developer to log properly :wink:

Greetings
Malte

2

Hi,

I found the issue in my script.

If there is a boolean of "arg0":false it will interfere with intentions if the field just exists.

Here it will get a value false and skip the loop.

So I have to check it before entering the ruby filter. Or is there a nicer way?

Greetings
Malte

3

I have found a way to verify boolean of false.
I found it here stackoverflow

        if event.get(field) and event.get(field).class != Hash
          event.set(field, {'original_value' => event.get(field)})
        elsif (!!event.get(field) == event.get(field)) and event.get(field).class != Hash
          event.set(field, {'original_value' => event.get(field)})
        end

So either it is true and no Hash or the double negative of false is "false" and this equals to "false".

Maybe someone needs this.

Greetings
Malte

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.