Use Ruby to get field string length

I am trying to get the string length of a dns domain name and place into a new field. I've seen several posts to use ruby to achieve this but I can't seem to get it to work. This code is placed inside the filter {} brackets. I've also tried variations where the single quotes are around all the '[dns][domain][name]' blocks. I'm getting a _rubyexecption in the tags.

ruby {
  code => "event['dns']['domain']['name']['size']  = event['dns']['domain']['name'].length"
 }

Use this

ruby {
  code => "event.set('[dns][domain][size]', event.get('[dns][domain][name]').length)"
 }

That did it! Thanks for the help and perhaps the fastest response I've ever seen on this site!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.