Suricata dashboard on 5.0 - Ruby issue

(Nick Minter) #1

Hi All,

On the new version of Logstash the ruby field references have changed.

As such the ruby code in the Logstash config here:

No longer works with the latest version.

The code is:
"if event['event_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to_s.split(',')[0]; end;"

Which i modified to be:
"if event.get('event_type') == 'fileinfo'; event.set('fileinfo''type')=event.get('fileinfo''magic').to_s.split(',')[0]; end;"

Which causes Logstash to go into a reboot loop.

Having not touched ruby at all ever, can anyone see what I'm doing wrong here?

(Magnus B├Ąck) #2

You're using the wrong syntax to reference nested fields. See for details and examples.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.