Ruby expression to check for a string in fluentd filter

Question

I need to create a new field 'status' if the log field contains a specific string. I tried below code in fluentd but this doesnt work. I need to check if the log field contains the string 'error:' then the new field status should have error else if it has ok it should have ok.

<filter **>
  @type record_transformer
  enable_ruby true
  <record>
    status "${\
      if record['log'].downcase.include? 'error:'
        puts 'error'
      elsif record['log'].downcase.include? 'ok:'
        puts 'ok'
      end}"
  </record>
</filter>

Can we use regexp to do this?

I also tried using scan.

<filter **>
  @type record_transformer
  enable_ruby true  
  <record>
   status ${record["log"].scan(/^.* ([[:<:]]error[[:>:]]|[[:<:]]ok[[:>:]]):.*$/i).first.compact} 
  </record>  
</filter>

Answer 1

I don't have much experience with fluentd other than reading their documentation now. But can you please check the following code snippet?

<filter **>
  @type record_transformer
  enable_ruby true
  <record>
    status "${record['log'].downcase.include?('error:') ? 'error' : (record['log'].downcase.include?('ok:') ? 'ok' : '')}"
  </record>
</filter>

I doubt puts on your snippet will work. So I kind of changed a little bit in the code. Let me know if this is something you are looking for.

Answer 2

You are trying to make status ok or error, using fluentd plugin record_transformer. You no need to use puts to assign the value to the variable. Below is the snippet that might help.

<filter abc.logs>
@type record_transformer
enable_ruby
<record>
   status ${if record["log"].include? "error: "; 'ERROR' ; else; 'OK' end; }
</record>

Be careful around the ;(semi-colons). These might be tricky :)