CODEWITHSUNDEEP
rubylogstashfilteringelk
Yoorae Kim
Yoorae Kim

Reputation: 3

How to access / address nested fields on Logstash

I am currently trying to convert a nested sub field that contains hexadecimal string to an int type field using Logstash filter

ruby{
    code => 'event.set("[transactions][gasprice_int]", event.get("[transactions][gasPrice]").to_i(16))'
  }

but it's returning the error

[ERROR][logstash.filters.ruby    ][main][2342d24206691f4db46a60285e910d102a6310e78cf8af43c9a2f1a1d66f58a8] Ruby exception occurred: wrong number of arguments calling `to_i` (given 1, expected 0)

I also tried looping through json objects in transactions field using

transactions_num = event.get("[transactions]").size
      transactions_num.times do |index|
        event.set("[transactions][#{index}][gasprice_int]", event.get("[transactions][#{index}][gasPrice].to_i(16)"))
      end

but this also returned an error of

[ERROR][logstash.filters.ruby    ][main][99b05fdb6022cc15b0f97ba10cabb3e7c1a8fabb8e0c47d6660861badffdb28e] Ruby exception occurred: Invalid FieldReference: `[transactions][0][gasPrice].to_i(16)`

This method of conversion of hex-string to int type using a ruby filter worked when I wasn't dealing with nested fields, so can anyone please help me how to correctly address nested fields in this case?

btw,

this is the code that still works

ruby {
    code => 'event.set("difficulty_int", event.get("difficulty").to_i(16))'
  }

Upvotes: 0

Views: 1631

Answers (1)

nullTerminator
nullTerminator

Reputation: 396

I think you have answered this one yourself in your final example - the to_i should not be inside the double quotes. So

...event.get("[transactions][#{index}][gasPrice].to_i(16)"))

should be

...event.get("[transactions][#{index}][gasPrice]").to_i(16))

Upvotes: 1

Related Questions