# Ruby syntax error only in logstash **URL:** https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488 **Category:** Logstash **Created:** [March 7, 2021, 9:10pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488 "2021-03-07T21:10:05Z") **Posts on this page:** 5 **Page:** 1
### Author: ![tangkalo](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tangkalo](https://discuss.elastic.co/u/tangkalo) #### Post date: [March 7, 2021, 9:10pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488/1 "2021-03-07T21:10:05Z")
Hi, I am trying to use the ruby plugin to parse a field of array type and then generate new fields out of some of elements. However, I encountered the following error. Similar ruby codes(i.e. the statement to set event) works in a regular ruby execution environment; therefore, I wonder if there is some problem escaping some key word or not in the following statement: - ` event.set("inboundKafkaFailedMessageCount", matched['inboundFailMessageCount'])` Thanks for any hints in advance. ``` ruby { code => ' event.get("[Kafka Consumer Web Check][errors]").each { |error| if matched = /Inbound Failed Messages (?.*) of (?.*) allowed. WARNING/.match(error) event.set("inboundKafkaFailedMessageCount", matched['inboundFailMessageCount']) event.set("inboundKafkaFailedMessageCountThreshold", matched['threshold']) end } }` ``` `[2021-03-04T13:41:42,498][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:logstash_expoacct_webcheck_qa, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"{\", \"}\" at line 54, column 65 (byte 2076) after filter {\n# json {\n#\tsource => \"results\"\n#\n# }\n\n\n mutate {\n add_field => {\n \"[fields][input_name]\" => \"expoacct_webcheck\"\n \"name\" => \"%{[metadata][name]}\"\n }\n add_field => {\n \"[fields][acctDbInfo]\" => \"%{[Database Checks][infos][0]}\" \n \"[fields][transactionLogInfo]\" => \"%{[Database Checks][infos][1]}\" \n \"[fields][spapDbInfo]\" => \"%{[Database Checks][infos][2]}\" \n }\n\n }\n\n\n dissect {\n mapping => { \"[fields][acctDbInfo]\" => \"%{} : %{acctDbUrl} (DB2/%{}) : %{acctDbStatus}\" }\n mapping => { \"[fields][transactionLogInfo]\" => \"Transaction Log Percent @ %{transactionLogPercent}%\"}\n mapping => { \"[fields][spapDbInfo]\" => \"%{} : %{spapDbUrl} (DB2/%{}) : %{spapDbStatus}\"}\n mapping => { \"[Kafka Consumer Web Check][errors][0]\" => \"Inbound Failed Messages %{inboundKafkaConsumerFailedMessageCount} of %{}\" }\n }\n\n ruby {\n code => '\n event.get(\"[Kafka Consumer Web Check][errors]\").each { |error|\n if matched = /Inbound Failed Messages (?.*) of (?.*) allowed. WARNING/.match(error)\n event.set(\"inboundKafkaFailedMessageCount\", matched['", :backtrace=>["/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/compiler.rb:58:in `compile\_imperative'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/compiler.rb:66:in `compile_graph'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/compiler.rb:28:in `block in compile\_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/compiler.rb:27:in `compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in `initialize'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/java\_pipeline.rb:44:in `initialize'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/prod/elastic/logstash-7.8.1/logstash-core/lib/logstash/agent.rb:356:in `block in converge_state'"]}` ---
### Author: ![tangkalo](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tangkalo](https://discuss.elastic.co/u/tangkalo) #### Post date: [March 7, 2021, 9:13pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488/2 "2021-03-07T21:13:31Z")
The following codes works at this website - [https://www.tutorialspoint.com/execute\_ruby\_online.php](https://here) errors = Array.( ``` "Inbound Failed Messages 129569 of 0 allowed. WARNING", "Outbound Failed Messages 2323 of 0 allowed. WARNING" ) ``` errors.each {|error| ``` if matched = /Inbound Failed Messages (?.*) of (?.*) allowed. WARNING/ .match(error) p matched['inboundFailMessageCount'] p matched['threshold'] end ``` } ---
### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger) #### Post date: [March 7, 2021, 11:26pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488/3 "2021-03-07T23:26:37Z")
> [@tangkalo](#): > > `matched['inboundFailMessageCount']` You are using single quotes for the code option of the ruby filter. I would use double quotes for the two references to matched, or you can probably escape the single quotes with backslashes. ---
### Author: ![tangkalo](https://avatars.discourse-cdn.com/v4/letter/t/cdc98d/32.png) [@tangkalo](https://discuss.elastic.co/u/tangkalo) #### Post date: [March 8, 2021, 4:57pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488/4 "2021-03-08T16:57:10Z")
Thanks. It turned out that the main culprit was the double quotes around it, plus the single quote. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [April 5, 2021, 4:58pm UTC](https://discuss.elastic.co/t/ruby-syntax-error-only-in-logstash/266488/5 "2021-04-05T16:58:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.