Using a variable like an index of an array in logstash pipeline


    ruby { code => 'event.set("patternmatch1", event.get("message").scan(/TEXT.*?(\w[\w,.]*)\r?$/))'

    # Retrieve the length of the array containing all the matches
    ruby { code => 'event.set("number_of_elements", event.get("patternmatch4").length-1)'

I would like to use the array length as the index of a ruby array of patterns to choose index pattern that i want. I am looking for element in last index of array

The below way is working like a charm,

       add_field => {"gross_profit" => "%{[patternmatch4][9]}"}}

I tried this way for dynamic index,

   add_field => {"gross_profit" => "%{[patternmatch4][%{[number_of_elements]}}"}

Simply how to use the variable which is given by ruby filter in array index.

Hi, it may not be possible to do this with logstash notation.

How about setting "gross_profit" with ruby, in the same code block you set "number_of_elements" ?

I guess that in ruby you can use "patternmatch4[number_of_elements]" or something alike.

I tried, its returning exception.

If the field "number_of_elements" is only needed for getting the last element of a field named "patternmatch4", you can just use the [-1] index in Ruby instead.

That way, you only need:

ruby {
    code => 'event.set("gross_profit", event.get("patternmatch4")[-1])'

If you really need the number_of_elements field (which actually contains the total number - 1 to match the index of the last element of the array) , here it is another example that might serve as inspiration to work with your patterns array:

  code => '
    number_of_elements = event.get("patternmatch4").length - 1
    event.set("number_of_elements", number_of_elements)
    event.set("gross_profit", event.get("patternmatch4")[number_of_elements])
1 Like

Awesome ! Thank you so much. Both are working.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.