Logstash红宝石过滤器和事件字段

Question

I am trying to capture IP address field from incoming logstash event and pass it on to a shell script to compare against a static black list. The issue is, I am able to print the IP addr using puts but not able to capture to pass it on to system() call in ruby filter. Here is my sample config.

I am using logstash 2.0

Sample input = {"name":"xyz", "source_ip":"8.8.8.8"}

input {

        stdin {
        codec => json
        }
}

filter {

        ruby {
        code => "
        # puts event['source_ip']  # This always works
        ip = event['source_ip']
        system('echo ${ip}')       # This echoes ${ip} instead of value !
        "
        }
}

I also tried ' echo #${ip} ' but it just prints 0 .

Answer 1

Instead of system('echo ${ip}') use below syntax to run shell commands:

puts `echo #{ip}`

Calling shell commands from Ruby