# Ruby syntax error after updating Logstash to 5.6.7

**URL:** <https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028>\
**Category:** Logstash\
**Created:** [February 1, 2018, 1:25pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028 "2018-02-01T13:25:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vicpav](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicpav](https://discuss.elastic.co/u/vicpav)\
**Post date:** [February 1, 2018, 1:25pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028/1 "2018-02-01T13:25:13Z")

</div>

To compensate the logging schema violations and to get Elasticsearch indexing happy I am trying to catch log lines where the field `message_json.msgObject.products` is an array of strings instead of array of hashes. In such a case, I am moving the strings into individual hashes with `id` key.

The Logstash filter looks like that:

```auto
  if [message_json][msgObject][products] {
    ruby {
      code => "
        products = event.get('[message_json][msgObject][products]')
        if (products.length > 0 and products[0].is_a?(String))
          products.map!{|product| {'id': product}}
        end
        }
        event.set('[message_json][msgObject][products]', products)
      "
    }
  }

```

That filter did not cause any issue when it was deployed to Logstash from [docker.elastic.co/logstash/logstash:5.6.6](http://docker.elastic.co/logstash/logstash:5.6.6).

However, when I changed the Logstash container to [docker.elastic.co/logstash/logstash:5.6.7](http://docker.elastic.co/logstash/logstash:5.6.7), I started to get errors during startup:

```auto
SyntaxError: (ruby filter code):5: syntax error, unexpected ':'
          products.map!{|product| {'id': product}}
                                       ^
              eval at org/jruby/RubyKernel.java:1079
          register at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-3.1.3/lib/logstash/filters/ruby.rb:59
          register at /usr/share/logstash/vendor/jruby/lib/ruby/1.9/forwardable.rb:201
   register_plugin at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290
  register_plugins at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301
              each at org/jruby/RubyArray.java:1613
  register_plugins at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301
     start_workers at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311
               run at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235
    start_pipeline at /usr/share/logstash/logstash-core/lib/logstash/agent.rb:408

```

It looks like jruby version did not change but ruby plugin is handled differently. Am I doing something stupid?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2018, 1:33pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028/2 "2018-02-01T13:33:39Z")

</div>

> ```
> {'id': product}
> 
> ```

Try `{'id' => product}`.

---

<div class="post-metadata">

**Author:** ![vicpav](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicpav](https://discuss.elastic.co/u/vicpav)\
**Post date:** [February 1, 2018, 1:46pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028/3 "2018-02-01T13:46:28Z")

</div>

That does not work either. Logstash 5.6.7 logs

```auto
SyntaxError: (ruby filter code):7: syntax error, unexpected tRCURLY
        }
        ^
              eval at org/jruby/RubyKernel.java:1079
          register at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-3.1.3/lib/logstash/filters/ruby.rb:59
          register at /usr/share/logstash/vendor/jruby/lib/ruby/1.9/forwardable.rb:201
   register_plugin at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290
  register_plugins at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301
              each at org/jruby/RubyArray.java:1613
  register_plugins at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:301
     start_workers at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:311
               run at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:235
    start_pipeline at /usr/share/logstash/logstash-core/lib/logstash/agent.rb:408

```

---

<div class="post-metadata">

**Author:** ![vicpav](https://avatars.discourse-cdn.com/v4/letter/v/9de053/32.png) [@vicpav](https://discuss.elastic.co/u/vicpav)\
**Post date:** [February 2, 2018, 7:11am UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028/4 "2018-02-02T07:11:54Z")

</div>

**Resolved**  
The `unexpected tRCURLY` error message was indeed showing the typo in the filter script. I had an extra curly bracket after if's `end`. I also saw that Ruby was "picky" when changing the array item type in place. Hence, I ended up with the filter like that

```auto
  if [message_json][msgObject][products] {
    ruby {
      code => "
        products = event.get('[message_json][msgObject][products]')
        if (products.length > 0 and products[0].is_a?(String))
          products_obj = []
          products.each { |product|
            products_obj.push({'id' => product})
          }
        end
        event.set('[message_json][msgObject][products]', products_obj)
      "
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2018, 7:12am UTC](https://discuss.elastic.co/t/ruby-syntax-error-after-updating-logstash-to-5-6-7/118028/5 "2018-03-02T07:12:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.