logstash 5 ruby filter

Question

I've recently upgraded an elk-stack cluster from an old version to 5.1 and although everything looks great, I have an exception occurring frequently in the logstash log, which looks like this:

logstash.filters.ruby Ruby exception occurred: Direct event field    references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the  Logstash 5.0 breaking changes documentation for more details.

The filter I have looks like this:

    filter {
    ruby {
        init => "require 'time'"
        code => "event.cancel if event['@timestamp'] < Time.now-(4*86400)"
    }
}

Any suggestions ?

Answer 1

The exception contains the answer:

Direct event field references (ie event['field']) have been disabled in favor of using event get and set methods (eg event.get('field')).

From that, it seems like event.get('@timestamp') is now preferred over event['@timestamp'].