# Running a Ruby external script to enrich event
**URL:** https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067
**Category:** Logstash
**Created:** [January 25, 2018, 3:38pm UTC](https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067 "2018-01-25T15:38:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)
#### Post date: [January 25, 2018, 3:38pm UTC](https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067/1 "2018-01-25T15:38:47Z")
Hi All,
I need to add some field in the events I'm processing with information about the country a phone number belogns to.
So, I'm parsing ok the phone numbers in the events and I want to run ruby code in order to add the country code in the event. For testing porpouses I put the ruby code inline (just with 3 countries) and worked ok, the GeoFrom field was added correctly.
Because the country list is very long I wanted to put the code in an external script, but in this case is not working.
What I'm doing wrong?
Thank you very much
Ana
` **Logstash configuration** `
```
grok{....}
date{...}
mutate{....}
ruby {
path => "/data/sbc/geo_info/geo.rb"
}
.....
```
**geo.rb code**
```
def filter (event)
case event.get('from')
when /\A376(.*)/
event.set('GeoFROM','AD')
when /\A34(.*)/
event.set('GeoFROM','ES')
when /\A39(.*)/
event.set('GeoFROM','IT')
else
event.set('GeoFROM','KK')
end
return [event]
end
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 25, 2018, 8:28pm UTC](https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067/2 "2018-01-25T20:28:27Z")
Why not just use a translate filter with the regexp option enabled?
---
### Author:  [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)
#### Post date: [January 26, 2018, 7:09am UTC](https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067/3 "2018-01-26T07:09:47Z")
Thank you very much Magnus!
Using the translate filter was the solution.
Here the code
**logstash.conf**
```
......
translate{
field => "from"
destination => "GeoFROM"
regex => true
exact => true
dictionary_path => '/data/sbc/geo_info/country_by_code.yaml'
}
.....
```
**Dictionary File**
```
cat /data/sbc/geo_info/country_by_code.yaml
'^376[0-9]*$': "AD"
'^34[0-9]*$': "ES"
'^33[0-9]*$': "FR"
'^49[0-9]*$': "DE"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 23, 2018, 7:09am UTC](https://discuss.elastic.co/t/running-a-ruby-external-script-to-enrich-event/117067/4 "2018-02-23T07:09:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.