# Unzip with ruby

**URL:** <https://discuss.elastic.co/t/unzip-with-ruby/161296>\
**Category:** Logstash\
**Created:** [December 18, 2018, 9:49am UTC](https://discuss.elastic.co/t/unzip-with-ruby/161296 "2018-12-18T09:49:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![00a45f9a00ca005db54c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/00a45f9a00ca005db54c/32/38003_2.png) [@00a45f9a00ca005db54c](https://discuss.elastic.co/u/00a45f9a00ca005db54c)\
**Post date:** [December 18, 2018, 9:49am UTC](https://discuss.elastic.co/t/unzip-with-ruby/161296/1 "2018-12-18T09:49:38Z")

</div>

I have flow python gzip script -\> rabbitMQ -\> logstash -\> ES  
If i subscribe to RMQ directly with python or ruby script - i can catch the message and decode it easily. But when it comes to logstash - ruby says that message is not in gzip format.

If I decode console-logged message with ruby - it works again. But inside logstash - nope.

For example: message inside console-log (between MESSAGE rows)

`\u001F\x8B\b\u0000\xAD\xBE\u0018\\\u0002\xFF\x8B\xAEVJ\xCDM\xCC\xCCQ\xB2RP\xCAr\xC8\xD2K\xCE\xCFU\xD2QPJ\xCE\xCF+IL.\u0001\x89\x82\xB8y\x89\xB9\xA9 \xB6\u0017\x90.\u0006\t\u0014gg\xE6\xE4\u0014\u0003\x85\xA2\x95\xB4\r\u0015\xCC\xCD-,--\r\f\f̕b\x81\x92\xA9)\xA5@\x99j\xA5\xD2t\xB0\x82\x80ʒ\x8C\xFC<\xB0L\u0001D\xC49X)\xB6\xB6VGa\xE0\xEC\x8E\u0005\u0000\xEB*\xA5\xA3\xF8\u0000\u0000\u0000`

Ruby exception occurred: not in gzip format

Logstash config:

```
input {
    rabbitmq {
        host => "localhost"
        port => 5672
        user => "guest"
        password => "guest"
        metadata_enabled => true
        queue => "kit_logstash"
        durable => true
        id => "rabbitmq_kit_event"
        exchange => "kit_local"
        codec => plain 
        type => "kitlog-rabbitmq"
    }
}

filter {
  if [type] == "kitlog-rabbitmq" {
    ruby {
      init => "
        require 'zlib'
        require 'stringio'
      "
      code => "
        body_decoded = event.get('message').to_s

        logger.info('===== MESSAGE =====')
        logger.info(body_decoded)
        logger.info('===== MESSAGE =====')

        sio = StringIO.new(body_decoded)
        gz = Zlib::GzipReader.new(sio)
        result = gz.read.to_s
        event.set('message', result)
      "
    }
  }
  json {
    source => "message"
    target => "message"
  }
  split {
    field => "message"
  }
}

output {
  stdout { codec => rubydebug }
  elasticsearch {
    hosts => "localhost"
    sniffing => false
    index => "kit_logs"
  }
}

```

Any ideas why ruby behaves like this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2019, 9:49am UTC](https://discuss.elastic.co/t/unzip-with-ruby/161296/2 "2019-01-15T09:49:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.