Logstash中的Ruby插件不起作用

Question

The ruby filter inside ruby filter raises an error at =>. I'm confused on how to make it work. I am supposed to remove fields from log files which has many json objects. I am removing the entries with very long keys.

 input {
 file {
type => "syslog"

# Wildcards work, here :)
path => ["C:\Users\ppurush\Desktop\test\*.log"]


 }
}

filter{
ruby {
 code =>"

     keyval = [url][queryString].split('&')

            for field in keyval
                result = field.split(': ')
                key = result[0]
                if key =~ /^.{50,}$/
          ruby {
                remove_field =>"[  "[url][queryString]" ]"
                }
            end
"
    }
}

output {
  stdout { }
  elasticsearch { embedded => true }
}

Answer 1

The ruby code is surrounded by double quotes, which means you can't use double quotes inside the ruby code itself.

Also, try catching errors:

ruby {
    code => "

      begin

        # your great code goes here

      rescue Exception => e

        event['ruby_exception'] = 'YOUR_FILTER_NAME: ' + e.message

      end

   "
}