Class: LogStash::Filters::Math

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/math.rb

Overview

Works with float and integer values

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/logstash/filters/math.rb', line 43

def filter(event)
  return unless filter?(event)
  for calculation in calculate do
    # Check that all the fields exist and are numeric
    next unless event.include?(calculation[1])
    next unless event.include?(calculation[2])
    next unless event[calculation[1]] == 0 or event[calculation[1]].is_a? Float or event[calculation[1]].is_a? Integer
    next unless event[calculation[2]] == 0 or event[calculation[2]].is_a? Float or event[calculation[2]].is_a? Integer
    case calculation[0]
    when "add"
      event[calculation[3]] = event[calculation[1]] + event[calculation[2]]
    when "sub"
      event[calculation[3]] = event[calculation[1]] - event[calculation[2]]
    when "div"
      # Avoid division by zero
      next if event[calculation[2]] == 0
      event[calculation[3]] = event[calculation[1]].to_f / event[calculation[2]]
    when "mpx"
      event[calculation[3]] = event[calculation[1]] * event[calculation[2]]
    end # case calculation[0]
  end # for each calculate
  filter_matched(event)
end

#register ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/logstash/filters/math.rb', line 29

def register
  # Do some sanity checks that calculate is actually an array-of-arrays, and that each calculation (sub-array)
  # is exactly 4 fields and the first field is a valid calculation opperator name.
  for calculation in calculate do
    if calculation.length % 4 != 0
      abort("Each calculation must have 4 elements, this one had " + calculation.length + " " + calculation.to_s )
    end # end calculaction.length is 4
    if ! calculation[0].match('^(add|sub|div|mpx)$' )
      abort("First element of a calculation must be add|sub|div|mpx, but is: " + calculation[0] )
    end # if calculation[0] valid
  end # for each calculate
end