ruby-logstash.conf

input {
  stdin { }
}

filter {

  grok {
    match => { "message" => "%{DATA:justtime} %{DATA:logsource} %{GREEDYDATA:msg}" }
  } #

  # incorrectly autopopulates to first day of year
  date {
    match => [ "justtime", "HH:mm.ss" ]
    target => "incorrectfulldatetime"
    timezone => "America/Los_Angeles"
  } # date

  # use ruby to augment with current day
  ruby {
    code => "
    event['fulldatetime'] = Time.now.strftime('%Y-%m-%d') + ' ' + event['justtime']
    "
  }
  date {
    match => [ "fulldatetime", "YYYY-MM-dd HH:mm.ss" ]
#    target => "correctfulldatetime"
    target => "@timestamp"
    timezone => "America/Los_Angeles"
  } # date



  # split apart log source to extract service name
  ruby {
    code => "
      fpath = event['logsource'].split('/')
      event['serviceName'] = fpath[fpath.length-2].downcase
    "
  }


  # append msg field to disk
  ruby {
    code => "
      File.open('/tmp/mydebug.log','a') { |f| f.puts event['msg'] }
    "
   }


   # call out to REST based echo service
   ruby {
     init => "
       require 'net/http'
       require 'json'
     "
     code => "
       firstWord = event['msg'].split(' ')[0]
       uri = URI.parse('http://echo.jsontest.com/word/' + firstWord)
       response = Net::HTTP.get_response(uri)
       if response.code == '200'
         result = JSON.parse(response.body)
         returnWord = result['word']
         event['echo'] = firstWord + ' echoed back as: ' + returnWord
       else
         event['echo'] = 'ERROR reaching web service'
       end
     "
   }


} # filter

output {
  stdout { codec => rubydebug }
}