Logstash ruby​​过滤条件语句错误

时间:2017-03-29 22:53:40

标签: elasticsearch logstash logstash-grok

我使用以下过滤器来检查字段是否为空。

 filter {
   ruby{
      code => '
        userPref = {}
        user = {}
        group = {}
        groups = []

        if event.get("stripecustomerid") == "null" {
          group["groupName"] =  event.get("groupname");
          group["role"] =  event.get("type");
          groups << group;
       }
       '
     }
}

但是在运行时,我收到以下错误,

SyntaxError: (ruby filter code):8: syntax error, unexpected tLCURLY
         if event.get("groupname") == "null" {
                                          ^
              eval at org/jruby/RubyKernel.java:1079
          register at /Users/Dummy/software/es/logstash-5.2.2/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-3.0.2/lib/logstash/filters/ruby.rb:38
          register at /Users/Dummy/software/es/logstash-5.2.2/vendor/jruby/lib/ruby/1.9/forwardable.rb:201
   register_plugin at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:282
  register_plugins at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:293
              each at org/jruby/RubyArray.java:1613
  register_plugins at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:293
     start_workers at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:303
               run at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:232
    start_pipeline at /Users/Dummy/software/es/logstash-5.2.2/logstash-core/lib/logstash/agent.rb:387

事件流看起来像这样,我想过滤掉&#34; null&#34;字段。

{"sqlId":1744,"minAllowance":{"hasSub":false,"subExpiry":0,"freeSec":1800,"freeSecExpiry":0},"groups":[{"groupName":null,"role":0}],"stripecustomerid":null

关于什么可能出错的任何想法?

0 个答案:

没有答案