record transformer and ruby problem !

[mareban]

Hi,

I'm trying to migrate our netflow from es2.4.1 to es6.1.2 ! I use the same config for the new elastic and the latest fluentd and packages updates !

Do something changed and do i have to modify the fluentd config to index our netflow now ??

Thanks for your help.

2018-05-03 17:53:19 +0200 [warn]: #0 dump an error event: error_class=RuntimeError error="failed to expand Resolv.getname(ipv4_src_addr) : error = undefined local variable or method ipv4_src_addr' for #Fluent::Plugin::RecordTransformerFilter::RubyPlaceholderExpander::CleanroomExpander:0x007f1a9be38048" location="/opt/td-agent/embedded/lib/ruby/gems/2.1.0/gems/fluentd-1.1.0/lib/fluent/plugin/filter_record_transformer.rb:310:inrescue in expand'"

my fluentd.conf

<filter netflow.event.**>
@type record_transformer
enable_ruby true

ipname_src_addr ${Resolv.getname(ipv4_src_addr)}
ipname_dst_addr ${Resolv.getname(ipv4_dst_addr)}
.....

[syepes]

This should do the trick

<filter netflow.event>
 @type record_transformer
 enable_ruby
 <record>
  ipv4_src_addr_name ${(Resolv.getname(record["ipv4_src_addr"]) rescue nil )}
  ipv4_dst_addr_name ${(Resolv.getname(record["ipv4_dst_addr"]) rescue nil )}
 </record>
</filter>