Ruby string test

Elastic Stack Logstash
1

Logstash 2.3.4:

Here the case
infos
"clientip" => [
[0] "151.38.152.143",
[1] "-"
],

ruby {
code => 'event["clientip"].each { |k,v| if v == "-" event["clientip2"][k] = v end } '
}

But when I run logstsah here is the error;
Settings: Default pipeline workers: 4
SyntaxError: (ruby filter code):1: syntax error, unexpected tIDENTIFIER
@codeblock = lambda { |event| event["clientip"].each { |k,v| if v == "-" event["clientip2"][k] = v end } }
^
eval at org/jruby/RubyKernel.java:1079
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.5/lib/logstash/filters/ruby.rb:29

dont know whats wrong

2

I think it's just a single vs. double quotes issue. Try something like this:

ruby {
code => "
event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end }
"
}

3

in fact i've been susipicious on the quote so i've already tried, here is what happened when I do this:

ruby {
code => "event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end }"
}

Settings: Default pipeline workers: 4
SyntaxError: (ruby filter code):1: syntax error, unexpected tIDENTIFIER
@codeblock = lambda { |event| event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end } }
^
eval at org/jruby/RubyKernel.java:1079
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.5/lib/logstash/filters/ruby.rb:29
start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:182
each at org/jruby/RubyArray.java:1613

It seems the problem is more on the IF
If ever I do:

ruby {
code => "event['clientip'].each { |k,v| event['clientip2'][k] = v }"
}

at this moment logstash start normally
Settings: Default pipeline workers: 4
Pipeline main started
^CSIGINT received. Shutting down the agent. {:level=>

4

As I didnt succeed in the clean to apply a condiition in the ruby code, here is what I did:

  • During the parsing on the grok filter, i have filtered the data, no more dash (-) in my data sent.

But at this moment, an other error present but unseen has been under the light, the Ipv4 and Ipv6 were not able to be store in the same field

  • I had to change the mapping from IP to string for the field, and now the data is processed.