Using field value as value in message[x]

Elastic Stack Logstash
1

Hi,
I would like to ask that i have field x => 0 it was an integer field value and i have a message[] array i want to consume the value of x inside the message for example: message[x] .
here is an example of my code:

filter {
mutate { split => {"message" => "|"} }
ruby {
      code => "event.set('x', 0)"
      }
mutate {
      add_field => { "test_x" => "%{x}" }
      add_field => { "DateTime" => "%{[message][%{x}]}" }
}
      ruby {
      code => "event.set('x', (event.get('x')) + 1)"
      }
mutate {
      add_field => { "GateWay" => "%{[message][2]}" }
}
}

add_field always adds strings ok but i want to use a integer value inside message %{[message][%{x}]} did not work

Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: `[message][%{x`"}

Also i tried to add this fied in ruby filter like this :

ruby {
      code => "event.set('x', (event.get('x')) + 1)
               event.set('field_name', event.get('[message][event.get('x')]'))
              "
      }

I did not find what to enter in this box event.get('[message][event.get('x')]')

Any help would be sincerely appreciate!
Thanks!

2

event.get('x') is just string and does not work as you expect.

How about this?

ruby {
      code => "event.set('x', (event.get('x')) + 1)
               event.set('field_name', event.get('[message][' + event.get('x') + ']'))
              "
      }
1 Like
3

Thank you for the reply @Tomo_M !
Still not working didn't add me the "field_name" :confused:

[ERROR][logstash.filters.ruby    ][main][56a490742ee0bc6336286e224b7d06224a9d39871e407d1979ac5bfe5e9f5cb0] Ruby exception occurred: no implicit conversion of Integer into String {:class=>"TypeError", :backtrace=>["org/jruby/RubyString.java:1182:in `+'", "(ruby filter code):3:in `block in filter_method'", "D:/elastic_stack/logstash-7.16.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:93:in `inline_script'", "D:/elastic_stack/logstash-7.16.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:86:in `filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1821:in `each'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/java_pipeline.rb:299:in `block in start_workers'"]}```
4

I found the solution :smiley:

ruby {
      code => "event.set('DateTime', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
              "
      }

Last thing it was about if statement in ruby filter or should i create a new topic ? just a small thing
here my code :

ruby {
      code => "event.set('DateTime', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               event.set('version', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               event.set('GateWay Op', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               if GateWay Op = PAIEMENT   
                    event.set('Idtra', event.get('message')[event.get('x')])
                    event.set('x', (event.get('x')) + 1)
               end           
              "
      }

I would like to know what is wrong and thank you!

1 Like
5

Thanks, I missed x field is integer.

That if statement should be:

if event.get('GateWay Op') == 'PAIEMENT'
  event.set(...

Another thing I wonder is the following code.

 mutate {
      add_field => { "GateWay" => "%{[message][2]}" }
}

I suppose the field format is recognized as the "2" field in "message" field. I know no way to set some value at a specific position of array by mutate filter plugin. Maybe you need ruby filter plugin.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.