# Ruby string test
**URL:** https://discuss.elastic.co/t/ruby-string-test/64299
**Category:** Logstash
**Created:** [October 28, 2016, 2:08pm UTC](https://discuss.elastic.co/t/ruby-string-test/64299 "2016-10-28T14:08:53Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Gregs](https://discuss.elastic.co/u/Gregs)
#### Post date: [October 28, 2016, 2:08pm UTC](https://discuss.elastic.co/t/ruby-string-test/64299/1 "2016-10-28T14:08:53Z")
Logstash 2.3.4:
Here the case
infos
"clientip" =\> [
[0] "151.38.152.143",
[1] "-"
],
ruby {
code =\> 'event["clientip"].each { |k,v| if v == "-" event["clientip2"][k] = v end } '
}
But when I run logstsah here is the error;
Settings: Default pipeline workers: 4
SyntaxError: (ruby filter code):1: syntax error, unexpected tIDENTIFIER
@codeblock = lambda { |event| event["clientip"].each { |k,v| if v == "-" event["clientip2"][k] = v end } }
^
eval at org/jruby/RubyKernel.java:1079
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.5/lib/logstash/filters/ruby.rb:29
dont know whats wrong
---
### Author:  [@davidpellerin](https://discuss.elastic.co/u/davidpellerin)
#### Post date: [October 28, 2016, 2:36pm UTC](https://discuss.elastic.co/t/ruby-string-test/64299/2 "2016-10-28T14:36:58Z")
> [@Gregs](#):
>
> ruby {
> code =\> 'event["clientip"].each { |k,v| if v == "-" event["clientip2"][k] = v end } '
> }
I think it's just a single vs. double quotes issue. Try something like this:
ruby {
code =\> "
event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end }
"
}
---
### Author:  [@Gregs](https://discuss.elastic.co/u/Gregs)
#### Post date: [October 28, 2016, 2:55pm UTC](https://discuss.elastic.co/t/ruby-string-test/64299/3 "2016-10-28T14:55:00Z")
in fact i've been susipicious on the quote so i've already tried, here is what happened when I do this:
ruby {
code =\> "event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end }"
}
* * *
Settings: Default pipeline workers: 4
SyntaxError: (ruby filter code):1: syntax error, unexpected tIDENTIFIER
@codeblock = lambda { |event| event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end } }
^
eval at org/jruby/RubyKernel.java:1079
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.5/lib/logstash/filters/ruby.rb:29
start\_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:182
each at org/jruby/RubyArray.java:1613
* * *
It seems the problem is more on the IF
If ever I do:
ruby {
code =\> "event['clientip'].each { |k,v| event['clientip2'][k] = v }"
}
at this moment logstash start normally
Settings: Default pipeline workers: 4
Pipeline main started
^CSIGINT received. Shutting down the agent. {:level=\>
---
### Author:  [@Gregs](https://discuss.elastic.co/u/Gregs)
#### Post date: [October 31, 2016, 9:04am UTC](https://discuss.elastic.co/t/ruby-string-test/64299/4 "2016-10-31T09:04:33Z")
As I didnt succeed in the clean to apply a condiition in the ruby code, here is what I did:
- During the parsing on the grok filter, i have filtered the data, no more dash (-) in my data sent.
But at this moment, an other error present but unseen has been under the light, the Ipv4 and Ipv6 were not able to be store in the same field
- I had to change the mapping from IP to string for the field, and now the data is processed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/ruby-string-test/64299/5 "2017-07-06T04:31:57Z")