Running a Ruby external script to enrich event

Elastic Stack Logstash
1

Hi All,
I need to add some field in the events I'm processing with information about the country a phone number belogns to.
So, I'm parsing ok the phone numbers in the events and I want to run ruby code in order to add the country code in the event. For testing porpouses I put the ruby code inline (just with 3 countries) and worked ok, the GeoFrom field was added correctly.
Because the country list is very long I wanted to put the code in an external script, but in this case is not working.
What I'm doing wrong?
Thank you very much
Ana

**Logstash configuration**

    grok{....}
    date{...}
    mutate{....}
    ruby {
                    path => "/data/sbc/geo_info/geo.rb"
            }


    .....

geo.rb code

def filter (event)
        case event.get('from')
                when /\A376(.*)/
                        event.set('GeoFROM','AD')
                when /\A34(.*)/
                        event.set('GeoFROM','ES')
                when /\A39(.*)/
                        event.set('GeoFROM','IT')
                else
                        event.set('GeoFROM','KK')
        end
return [event]
end
2

Why not just use a translate filter with the regexp option enabled?

1 Like
3

Thank you very much Magnus!
Using the translate filter was the solution.
Here the code

logstash.conf

......
        translate{
                field => "from"
                destination => "GeoFROM"
                regex => true
                exact => true
                dictionary_path => '/data/sbc/geo_info/country_by_code.yaml'
        }
.....

Dictionary File

 cat /data/sbc/geo_info/country_by_code.yaml
'^376[0-9]*$': "AD"
'^34[0-9]*$': "ES"
'^33[0-9]*$': "FR"
'^49[0-9]*$': "DE"
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.