logstash统计event的count数的时候报错

Question

如下是logstash的filter的部分配置文件
if "metric" in [tags] {
  ruby {
      code => "event.cancel if event'[events_[MainThread]][count]' < 500"
  }

}
这里统计到最后会提示报错Ruby exception occurred: comparison of String with 500 failed
新手，请各位大神帮忙看看怎么解决。。

Answer 1

整个filter文件
filter {
if [message] !~ "Thread-2|MainThread" {
ruby {
code => "event.cancel"
}
}

grok{
    patterns_dir => "D:/logstash-5.1.1/logstash-5.1.1/bin/pattern"
    match => ["message", "%{KeyWord:word}"]
    add_tag => "warn"
}

metrics{
    meter => "events_%{[word]}"
    add_tag => "metric"
    flush_interval =>30
    clear_interval =>31
}

if "metric" in [tags] {
  ruby {
      code => "event.cancel if event'[events_[MainThread]][count]' < 500"
  }

}
}