CODEWITHSUNDEEP
rubyfilterlogstash
mike
mike

Reputation: 787

logstash - use ruby code inside of a filter

is it possible to use ruby code inside of a filter? something like this:

filter {
 csv{
   ruby {
      code => "
            fieldArray = event['message'].split(',')
            for field in fieldArray
                event[field] = field
            end
        "
        }
   }
}

Upvotes: 1

Views: 8304

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

No, csv{} is a filter and ruby{} is a filter, so they don't nest inside each other as you've shown.

You haven't described the problem, but perhaps just using ruby{} is what you're looking for.

EDIT: with more information on the problem, here are some more notes:

Logstash runs one event at a time, so for csv{}, it's processing one line from the file at a time. Even with the ruby{} filter, you don't get a look at the entire input.

Since the header row is first, however, you should be able to drop into ruby{}, tuck away the columns of this row into a persistent variable, and, for subsequent rows, loop through the fields in ruby and rename them.

You could also extend the csv{} filter to be "header aware", which would benefit a good population of logstash users.

Upvotes: 1

Related Questions