in fact i've been susipicious on the quote so i've already tried, here is what happened when I do this:
ruby {
code => "event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end }"
}
Settings: Default pipeline workers: 4
SyntaxError: (ruby filter code):1: syntax error, unexpected tIDENTIFIER
@codeblock = lambda { |event| event['clientip'].each { |k,v| if v == '-' event['clientip2'][k] = v end } }
^
eval at org/jruby/RubyKernel.java:1079
register at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.5/lib/logstash/filters/ruby.rb:29
start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:182
each at org/jruby/RubyArray.java:1613
It seems the problem is more on the IF
If ever I do:
ruby {
code => "event['clientip'].each { |k,v| event['clientip2'][k] = v }"
}
at this moment logstash start normally
Settings: Default pipeline workers: 4
Pipeline main started
^CSIGINT received. Shutting down the agent. {:level=>