Logstash conditional to check that field is an object?

Question

When I know name of one of fields in expected object, I can use

if [check_if_this_is_an_object][known_field_name] { # object } else { # not an object }

But I would like a way to do a general check, without known field name.

Answer 1

You will need to use a ruby filter is you do not know the name of any of the fields within the object. If you just need to check one field you could use

    ruby {
        code => '
            field = event.get("foo")
            if field.respond_to? "each"
                answer = true
            elsif field.is_a? LogStash::Timestamp
                answer = true
            else
                answer = false
            end
            event.set("[@metadata][fooObject]", answer)
        '
    }

If you need to check multiple fields then use a script file. The script would be

def register(params)
    @fieldName = params["field"]
end

def filter(event)
    field = event.get(@fieldName)
    if field.respond_to? "each" # Array or Hash
        answer = true
    elsif field.is_a? LogStash::Timestamp
        answer = true
    else # boolean, integer, float or string
        answer = false
    end
    event.set("[@metadata][#{@fieldName}Object]", answer)
    [event]
end

and then call it using

    ruby {
        path => "/home/user/isObject.rb"
        script_params => { "field" => "foo" }
    }
    ruby {
        path => "/home/user/isObject.rb"
        script_params => { "field" => "bar" }
    }

and then you can write a conditional using [@metadata][fooObject] or [@metadata][barObject]