# Ruby script for auditd EXECVE logs

**URL:** <https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098>\
**Category:** Logstash\
**Created:** [February 21, 2023, 7:00pm UTC](https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098 "2023-02-21T19:00:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JCW](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcw/32/116068_2.png) [@JCW](https://discuss.elastic.co/u/JCW)\
**Post date:** [February 21, 2023, 7:00pm UTC](https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098/1 "2023-02-21T19:00:58Z")

</div>

I want to make a ruby script that makes an extra field for "command" that it parses out of the message that auditd creates, however it does not work and I am unable to figure out why.

**example log:**  
`type=EXECVE msg=audit(1676645236.583:93680): argc=2 a0="hostname" a1="-f"`

**part of the logstash config in question:**

```auto
mutate {
          add_field => { "command" => "" }
}

                if "type=EXECVE" in [message] {
                        ruby {
                                code => '
def filter(event)
    if event.get("message").include?("type=execve")
      args = ""
      99.times do |i|
        break unless event.include?("a" + (i+0).to_s)
        args += event.get(("a" + (i+0).to_s) + " ")
      end
      event.set("command", args.strip)

      event.remove("a%{[0-9]+}")
    end

    return [event]
end'
                         }
                }

```

**Ruby script:**

```auto
def filter(event)
  if event.get("message").include?("type=execve")
    args = ''
    99.times do |i|
      break unless event.include?('a' + (i+0).to_s)
      args += event.get(('a' + (i+0).to_s) + ' ')
    end
    event.set('command', args.strip)
    event.remove("a%{[0-9]+}")
  end
  return [event]
end

```

**current output:**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/1/41507f719fb21fb57e57ea4e54ce0a35b91f5701.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 21, 2023, 10:36pm UTC](https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098/2 "2023-02-21T22:36:43Z")

</div>

A ruby filter can use inline code (the code/init options) or a script in a file (the path option).

With the path option you define a filter method that returns an array of events and it gets called for each event.

With the code/init options you write a lambda that references a variable called event. You use event.get/set/remove etc. to modify it.

You have written code in the first form but invoke it using the second. That will not work. For every event your function will get redefined, but not called.

When using init/code define functions in the init block and call them in the code block.

I would implement this using

```
    kv { source => "message" target => "[@metadata][kvData]" }
    if [@metadata][kvData][type] == "EXECVE" {
        ruby {
            code => '
                argc = event.get("[@metadata][kvData][argc]").to_i
                command = ""
                (0 ... argc).each { |x| command += event.remove("[@metadata][kvData][a#{x}]") + " " }
                event.set("command", command.chop)
            '
        }
    }

```

---

<div class="post-metadata">

**Author:** ![JCW](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcw/32/116068_2.png) [@JCW](https://discuss.elastic.co/u/JCW)\
**Post date:** [February 21, 2023, 10:53pm UTC](https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098/3 "2023-02-21T22:53:09Z")

</div>

Incredible, thank you. It works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2023, 10:53pm UTC](https://discuss.elastic.co/t/ruby-script-for-auditd-execve-logs/326098/4 "2023-03-21T22:53:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.