Using a variable like an index of an array in logstash pipeline

[Md_Iburahimsha_S]

filter{

    ruby { code => 'event.set("patternmatch1", event.get("message").scan(/TEXT.*?(\w[\w,.]*)\r?$/))'
    }

    # Retrieve the length of the array containing all the matches
    ruby { code => 'event.set("number_of_elements", event.get("patternmatch4").length-1)'
    }

I would like to use the array length as the index of a ruby array of patterns to choose index pattern that i want. I am looking for element in last index of array

The below way is working like a charm,

mutate{
       add_field => {"gross_profit" => "%{[patternmatch4][9]}"}}
}

I tried this way for dynamic index,

mutate{
   add_field => {"gross_profit" => "%{[patternmatch4][%{[number_of_elements]}}"}
}

Simply how to use the variable which is given by ruby filter in array index.

[andres-perez (Andrés Pérez)]

Hi, it may not be possible to do this with logstash notation.

How about setting "gross_profit" with ruby, in the same code block you set "number_of_elements" ?

I guess that in ruby you can use "patternmatch4[number_of_elements]" or something alike.

[Md_Iburahimsha_S]

I tried, its returning exception.

[andres-perez (Andrés Pérez)]

If the field "number_of_elements" is only needed for getting the last element of a field named "patternmatch4", you can just use the [-1] index in Ruby instead.

That way, you only need:

ruby {
    code => 'event.set("gross_profit", event.get("patternmatch4")[-1])'
}

If you really need the number_of_elements field (which actually contains the total number - 1 to match the index of the last element of the array) , here it is another example that might serve as inspiration to work with your patterns array:

ruby{
  code => '
    number_of_elements = event.get("patternmatch4").length - 1
    event.set("number_of_elements", number_of_elements)
    event.set("gross_profit", event.get("patternmatch4")[number_of_elements])
  '
}

[Md_Iburahimsha_S]

@andres-perez

ruby{ code => ' number_of_elements = event.get("patternmatch4").length - 1 event.set("number_of_elements", number_of_elements) event.set("gross_profit", event.get("patternmatch4")[number_of_elements]) ' }

Awesome ! Thank you so much. Both are working.