Class: LogStash::Event

Inherits:
Object
  • Object
show all
Defined in:
lib/logstash/event.rb

Overview

General event type. Basically a light wrapper on top of a hash.

TODO(sissel): properly handle lazy properties like parsed time formats, urls, etc, as necessary.

Constant Summary collapse

@@date_parser = 
Java::org.joda.time.format.ISODateTimeFormat.dateTimeParser.withOffsetParsed

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(data = nil) ⇒ Event

Returns a new instance of Event.



14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/logstash/event.rb', line 14

def initialize(data=nil)
  @cancelled = false

  @data = {
    "@source" => "unknown",
    "@tags" => [],
    "@fields" => {},
  }
  @data.merge!(data) unless data.nil?
  @data["@timestamp"] ||= LogStash::Time.now
end

Class Method Details

.from_json(json) ⇒ Object 



34
35
36
 
# File 'lib/logstash/event.rb', line 34

def self.from_json(json)
  return LogStash::Event.new(JSON.parse(json))
end

Instance Method Details

#==(other) ⇒ Object 



275
276
277
278
279
280
281
282
 
# File 'lib/logstash/event.rb', line 275

def ==(other)
  #puts "#{self.class.name}#==(#{other.inspect})"
  if !other.is_a?(self.class)
    return false
  end

  return other.to_hash == self.to_hash
end

#[](key) ⇒ Object 



116
117
118
119
120
121
122
123
124
 
# File 'lib/logstash/event.rb', line 116

def [](key)
  # If the key isn't in fields and it starts with an "@" sign, get it out of data instead of fields
  if ! @data["@fields"].has_key?(key) and key.slice(0,1) == "@"
    return @data[key]
  # Exists in @fields (returns value) or doesn't start with "@" (return null)
  else
    return @data["@fields"][key]
  end
end

#[]=(key, value) ⇒ Object 



127
128
129
130
131
132
133
 
# File 'lib/logstash/event.rb', line 127

def []=(key, value)
  if @data.has_key?(key)
    @data[key] = value
  else
    @data["@fields"][key] = value
  end
end

#append(event) ⇒ Object 



153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
 
# File 'lib/logstash/event.rb', line 153

def append(event)
  if event.message
    if self.message
      self.message += "\n" + event.message 
    else
      self.message = event.message
    end
  end
  self.tags |= event.tags

  # Append all fields
  event.fields.each do |name, value|
    if self.fields.include?(name)
      if !self.fields[name].is_a?(Array)
        self.fields[name] = [self.fields[name]]
      end
      if value.is_a?(Array)
        self.fields[name] |= value
      else
        self.fields[name] << value unless self.fields[name].include?(value)
      end
    else
      self.fields[name] = value
    end
  end # event.fields.each
end

#cancel ⇒ Object 



39
40
41
 
# File 'lib/logstash/event.rb', line 39

def cancel
  @cancelled = true
end

#cancelled? ⇒ Boolean

Returns:

  • (Boolean) 


44
45
46
 
# File 'lib/logstash/event.rb', line 44

def cancelled?
  return @cancelled
end

#clone ⇒ Object 



50
51
52
53
54
55
56
57
 
# File 'lib/logstash/event.rb', line 50

def clone
  newdata = @data.clone
  newdata["@fields"] = {}
  fields.each do |k,v|
    newdata["@fields"][k] = v.clone
  end
  return LogStash::Event.new(newdata)
end

#fields ⇒ Object

def []=



135
 
# File 'lib/logstash/event.rb', line 135

def fields; return @data["@fields"] end

#include?(key) ⇒ Boolean

Returns:

  • (Boolean) 


147
148
149
 
# File 'lib/logstash/event.rb', line 147

def include?(key)
  return (@data.include?(key) or @data["@fields"].include?(key))
end

#message ⇒ Object

def message



103
 
# File 'lib/logstash/event.rb', line 103

def message; @data["@message"]; end

#message=(val) ⇒ Object

def message=



104
 
# File 'lib/logstash/event.rb', line 104

def message=(val); @data["@message"] = val; end

#overwrite(event) ⇒ Object 



142
143
144
 
# File 'lib/logstash/event.rb', line 142

def overwrite(event)
  @data = event.to_hash
end

#remove(field) ⇒ Object 



182
183
184
185
186
187
188
 
# File 'lib/logstash/event.rb', line 182

def remove(field)
  if @data.has_key?(field)
    @data.delete(field)
  else
    @data["@fields"].delete(field)
  end
end

#source ⇒ Object

def source



80
 
# File 'lib/logstash/event.rb', line 80

def source; @data["@source"]; end

#source=(val) ⇒ Object 



81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/logstash/event.rb', line 81

def source=(val) 
  uri = URI.parse(val) rescue nil
  val = uri if uri
  if val.is_a?(URI)
    @data["@source"] = val.to_s
    @data["@source_host"] = val.host
    @data["@source_path"] = val.path
  else
    @data["@source"] = val
    @data["@source_host"] = val
  end
end

#source_host ⇒ Object

def source_host



95
 
# File 'lib/logstash/event.rb', line 95

def source_host; @data["@source_host"]; end

#source_host=(val) ⇒ Object

def source_host=



96
 
# File 'lib/logstash/event.rb', line 96

def source_host=(val); @data["@source_host"] = val; end

#source_path ⇒ Object

def source_path



99
 
# File 'lib/logstash/event.rb', line 99

def source_path; @data["@source_path"]; end

#source_path=(val) ⇒ Object

def source_path=



100
 
# File 'lib/logstash/event.rb', line 100

def source_path=(val); @data["@source_path"] = val; end

#sprintf(format) ⇒ Object 



207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
 
# File 'lib/logstash/event.rb', line 207

def sprintf(format)
  if format.index("%").nil?
    return format
  end

  return format.gsub(/%\{[^}]+\}/) do |tok|
    # Take the inside of the %{ ... }
    key = tok[2 ... -1]

    if key == "+%s"
      # Got %{+%s}, support for unix epoch time
      if RUBY_ENGINE != "jruby"
        # This is really slow. See LOGSTASH-217
        Date.parse(self.timestamp).to_i
      else
        datetime = @@date_parser.parseDateTime(self.timestamp)
        (datetime.getMillis / 1000).to_i
      end
    elsif key[0,1] == "+"
      # We got a %{+TIMEFORMAT} so use joda to format it.
      if RUBY_ENGINE != "jruby"
        # This is really slow. See LOGSTASH-217
        datetime = Date.parse(self.timestamp)
        format = key[1 .. -1]
        datetime.strftime(format)
      else
        datetime = @@date_parser.parseDateTime(self.timestamp)
        format = key[1 .. -1]
        datetime.toString(format) # return requested time format
      end
    else
      # Use an event field.
      value = nil
      obj = self

      # If the top-level value exists, use that and don't try
      # to "look" into data structures.
      if self[key]
        value = self[key]
      else
        # "." is what ES uses to access structured data, so adopt that
        # idea here, too.  "foo.bar" will access key "bar" under hash "foo".
        key.split('.').each do |segment|
          if obj
            value = obj[segment] rescue nil
            obj = obj[segment] rescue nil
          else
            value = nil
            break
          end
        end # key.split.each
      end # if self[key]

      case value
      when nil
        tok # leave the %{foo} if this field does not exist in this event.
      when Array
        value.join(",") # Join by ',' if value is an array
      when Hash
        value.to_json # Convert hashes to json
      else
        value # otherwise return the value
      end
    end
  end
end

#tags ⇒ Object

def tags



111
 
# File 'lib/logstash/event.rb', line 111

def tags; @data["@tags"]; end

#tags=(val) ⇒ Object

def tags=



112
 
# File 'lib/logstash/event.rb', line 112

def tags=(val); @data["@tags"] = val; end

#timestamp ⇒ Object

def timestamp



65
 
# File 'lib/logstash/event.rb', line 65

def timestamp; @data["@timestamp"]; end

#timestamp=(val) ⇒ Object

def timestamp=



66
 
# File 'lib/logstash/event.rb', line 66

def timestamp=(val); @data["@timestamp"] = val; end

#to_hash ⇒ Object

def to_hash



139
 
# File 'lib/logstash/event.rb', line 139

def to_hash; return @data end

#to_json(*args) ⇒ Object

def to_json



138
 
# File 'lib/logstash/event.rb', line 138

def to_json(*args); return @data.to_json(*args) end

#to_s ⇒ Object 



60
61
62
 
# File 'lib/logstash/event.rb', line 60

def to_s
  return self.sprintf("%{@timestamp} %{@source}: %{@message}")
end

#type ⇒ Object

def type



107
 
# File 'lib/logstash/event.rb', line 107

def type; @data["@type"]; end

#type=(val) ⇒ Object

def type=



108
 
# File 'lib/logstash/event.rb', line 108

def type=(val); @data["@type"] = val; end

#unix_timestamp ⇒ Object 



69
70
71
72
73
74
75
76
77
 
# File 'lib/logstash/event.rb', line 69

def unix_timestamp
  if RUBY_ENGINE != "jruby"
    # This is really slow. See LOGSTASH-217
    return Time.parse(timestamp).to_f
  else
    time = @@date_parser.parseDateTime(timestamp)
    return time.getMillis.to_f / 1000
  end
end