Handling exceptions in the ruby{} filter

If you need to drop into ruby for your processing, be sure to handle any exceptions. ┬áIf you don’t, the filter worker will exit, possibly halting your processing.

The following code will allow the worker to continue, and will add a field to the event so you can track them down later:

    ruby {
        code => "
            # your great code goes here
          rescue Exception => e
            event['ruby_exception'] = 'YOUR_FILTER_NAME: ' + e.message


I add a panel for this field to my cluster health dashboard in kibana.

Leave a Reply

Your email address will not be published. Required fields are marked *