# Use ruby variable in if filter
**URL:** https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251
**Category:** Logstash
**Created:** [June 29, 2017, 8:58am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251 "2017-06-29T08:58:41Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@kitz99](https://discuss.elastic.co/u/kitz99)
#### Post date: [June 29, 2017, 8:58am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251/1 "2017-06-29T08:58:41Z")
I have this logstash config:
```
input { stdin { } }
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
filter {
ruby {
code => "
@@exists_pattern = ['/collaboration/display', '/collaboration/questions'].any?{ |pattern| event.get('message').include?(pattern) }
event.add('keep_line', @@exists_pattern)
"
}
if not [keep_line] { drop { } }
grok {
match => {
"message" => '%{IP:serverip} \[%{HTTPDATE:my_timestamp}\]'
}
}
date {
match => ["my_timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
target => "@timestamp"
}
}
```
But when I try to run logstash with this config file I get this error message:
```
[ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, ( at line 30, column 10 (byte 923) after filter {\n # grok {\n
```
How can I use field 'keep\_line' in that if condition?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2017, 9:02am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251/2 "2017-06-29T09:02:51Z")
Yes. "keep\_line" isn't a Ruby variable, it's a field in the current event. I'm not sure what Logstash is complaining about. Judging by the error message there's something about the grok filter that it doesn't like. Try commenting out pieces of the configuration to narrow down the cause of the error.
---
### Author:  [@kitz99](https://discuss.elastic.co/u/kitz99)
#### Post date: [June 29, 2017, 9:05am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251/3 "2017-06-29T09:05:59Z")
grok seems to be ok. If I comment it, I still get this error:
[ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, ( at line 16, column 10 (byte 350) after filter {\n ruby {\n code =\> "\n @@exists\_pattern = ['/collaboration/display', '/collaboration/questions'].any?{ |pattern| event.get('message').include?(pattern) }\n event.add('keep\_line', @@exists\_pattern)\n "\n }\n\n if not "}
2017-06-29 12:05:03,847 Api Webserver ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console.
---
### Author:  [@kitz99](https://discuss.elastic.co/u/kitz99)
#### Post date: [June 29, 2017, 9:42am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251/4 "2017-06-29T09:42:05Z")
The problem seems to be with `not [keep_line]`. I switched to `if [keep_line]` and logstash started. I keep digging
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2017, 9:42am UTC](https://discuss.elastic.co/t/use-ruby-variable-in-if-filter/91251/5 "2017-07-27T09:42:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.