Using a variable like an index of an array in logstash pipeline

Elastic Stack Logstash
1 
filter{

    ruby { code => 'event.set("patternmatch1", event.get("message").scan(/TEXT.*?(\w[\w,.]*)\r?$/))'
    }

    # Retrieve the length of the array containing all the matches
    ruby { code => 'event.set("number_of_elements", event.get("patternmatch4").length-1)'
    }

I would like to use the array length as the index of a ruby array of patterns to choose index pattern that i want. I am looking for element in last index of array

The below way is working like a charm,

mutate{
       add_field => {"gross_profit" => "%{[patternmatch4][9]}"}}
}

I tried this way for dynamic index,

mutate{
   add_field => {"gross_profit" => "%{[patternmatch4][%{[number_of_elements]}}"}
}

Simply how to use the variable which is given by ruby filter in array index.

2

Hi, it may not be possible to do this with logstash notation.

How about setting "gross_profit" with ruby, in the same code block you set "number_of_elements" ?

I guess that in ruby you can use "patternmatch4[number_of_elements]" or something alike.

3

I tried, its returning exception.

4

If the field "number_of_elements" is only needed for getting the last element of a field named "patternmatch4", you can just use the [-1] index in Ruby instead.

That way, you only need:

ruby {
    code => 'event.set("gross_profit", event.get("patternmatch4")[-1])'
}

If you really need the number_of_elements field (which actually contains the total number - 1 to match the index of the last element of the array) , here it is another example that might serve as inspiration to work with your patterns array:

ruby{
  code => '
    number_of_elements = event.get("patternmatch4").length - 1
    event.set("number_of_elements", number_of_elements)
    event.set("gross_profit", event.get("patternmatch4")[number_of_elements])
  '
}
1 Like
5

Awesome ! Thank you so much. Both are working.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.