CODEWITHSUNDEEP
rubylogstashlogstash-configuration
Pooja
Pooja

Reputation: 883

Ruby plugin in logstash not working

The ruby filter inside ruby filter raises an error at =>. I'm confused on how to make it work. I am supposed to remove fields from log files which has many json objects. I am removing the entries with very long keys. 

 input {
 file {
type => "syslog"

# Wildcards work, here :)
path => ["C:\Users\ppurush\Desktop\test\*.log"]


 }
}

filter{
ruby {
 code =>"

     keyval = [url][queryString].split('&')

            for field in keyval
                result = field.split(': ')
                key = result[0]
                if key =~ /^.{50,}$/
          ruby {
                remove_field =>"[  "[url][queryString]" ]"
                }
            end
"
    }
}

output {
  stdout { }
  elasticsearch { embedded => true }
}

Upvotes: 0

Views: 1605

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

The ruby code is surrounded by double quotes, which means you can't use double quotes inside the ruby code itself.

Also, try catching errors:

ruby {
    code => "

      begin

        # your great code goes here

      rescue Exception => e

        event['ruby_exception'] = 'YOUR_FILTER_NAME: ' + e.message

      end

   "
}

Upvotes: 2

Related Questions