The new variable in the filter ruby event must be set() before it can be used?

Elastic Stack Logstash
1 
   ruby {
     code => "
       pubtime_new = event.get('[pubtime]').to_i * 1000
       event.set('pubtime_new',pubtime_new)             >>>> If I don't register pubtime_new then below can't get the value of pubtime_new.
       timeset = event.get('[timestamp_us]').to_i - event.get('[pubtime_new]').to_i
       event.set('timeset',timeset)
       event.set('delay_time_us', event.get('[pubtime]').to_i - event.get('[device_timestamp]').to_i)
       event.set('pub_subtime_us', timeset + event.get('[transaction_duration_us]').to_i )
    "
   }

Maybe I don't understand it correctly, and I don't know much about ruby, I just want to ask if there are other ways to directly refer to the new variable.

2

You can do

   pubtime_new = event.get('[pubtime]').to_i * 1000
   timeset = event.get('[timestamp_us]').to_i - pubtime_new

and reference the ruby variable, just as you do with timeset.

3

I wrote it like this at the beginning, but the value of pub_subtime_us is wrong.
timeset = event.get('[timestamp_us]').to_i - pubtime_new

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.