require_relative "lib/bootstrap/environment" LogStash::Bundler.setup!({:without => [:build, :development]}) require "logstash-core" require "logstash/environment" require "logstash/plugin" grok_class = LogStash::Plugin.lookup("filter", "grok") grok = grok_class.new("match" => { "message" => [ "%{WORD:word}", "%{NUMBER:num}" ] }) grok.register event = LogStash::Event.new("message" => "hey") grok.filter(event) puts event.to_hash # /tmp/logstash-7.6.0 # ❯ bin/ruby script.rb # {"word"=>"hey", "@timestamp"=>2020-03-05T16:19:19.322Z, "@version"=>"1", "message"=>"hey"}