"Undefined method `gsub!'" when executes a Ruby filter to change timezone

Elastic Stack Logstash
1

Hi,

I have an issue when I tried to parse a date string to a date fiel with a different timezone, below the info

--- Filter configuration

input {
 stdin { }
}
filter {
date {
      match => ["message", "yyyy-MM-dd HH:mm:ss"]
      target => "justtime"
     }
ruby {
       init => 'require "time"'
       code => ' event.set("newtime", Time.parse(event.get("justtime")).localtime("-05:00")).sfrtime("%Y-%m-%d %H:%M:%S")
               '
      }

     } # filter
output {
    stdout { codec => rubydebug }
}

---- Execution command

$ echo '2019-04-17 15:00:01'  | /usr/share/logstash/bin/logstash -r -f "/usr/share/logstash/ruby-logstash.conf"

----- output
[ERROR] 2019-05-09 10:40:40.036 [[main]>worker1] ruby - Ruby exception occurred: undefined method `gsub!' for 2019-04-17T22:00:01.000Z:LogStash::Timestamp
{
"@version" => "1",
"@timestamp" => 2019-05-09T17:40:39.252Z,
"host" => "localhost.localdomain",
"message" => "2019-04-17 15:00:01",
"justtime" => 2019-04-17T22:00:01.000Z,
"tags" => [
[0] "_rubyexception"
]
}

2

Wouldn't it be easier to use the timezone option on the date filter?

Also, you are calling sftime (do you mean strftime) on whatever event.set returns, so that is a no-op.

3

Hi Badger,

I tried to use "timezone" in Date filter, my issue is that the input date is already in GMT and I need this value with my localtime to extract the "hour of day" and "day of week".

I mean the opposite function, I read other topics where it says the only way is using Ruby code to do that.

Thanks for any advise

PD. I fixed the functions 'stfrtime' and I have the same error

4

I am unable to reproduce the issue, but this

input { generator { count => 1 lines => [ '2018-11-02 14:31:01' ] } }

filter {
    date {
        match => ["message", "yyyy-MM-dd HH:mm:ss"]
        target => "justtime"
    }
    ruby {
        init => 'require "time"'
        code => '
            t = event.get("justtime").to_s
            event.set("newtime", Time.parse(t).localtime("-07:00").strftime("%Y-%m-%d %H:%M:%S"))
        '
    }
}

produces

   "newtime" => "2018-11-02 11:31:01",
  "justtime" => 2018-11-02T18:31:01.000Z
5

Thanks Badger,

It works, but I need to clarify to other people that checks this post using an example with ("-12:00") as parameter in Ruby code (I'm in Mexico and this post was wrote in May 14, 2019 at 16:00:01 localtime )

   "message" => "2019-05-14 21:00:01",     --- Datetime  GMT/UTC in my log file
"@timestamp" => 2019-05-14T21:00:45.406Z,  --- Datetime right now in UTC/GMT
  "justtime" => 2019-05-15T04:00:01.000Z,  --- "message" moved  7 hours to the future, Logstash is trying to put in GMT/UTC according their rules
   "newtime" => "2019-05-14 16:00:01",     --- "Justtime" less 12 hours to be in my localtime
      "host" => "localhost.localdomain",
  "@version" => "1",
  "sequence" => 0
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.