Class: Fluent::Plugin::TimeCutoffFilter

Inherits:
Filter
  • Object
show all
Defined in:
lib/fluent/plugin/filter_time_cutoff.rb

Overview

A filter plugin that allows Fluentd to modify or drop messages that are newer or older than a set threshold. By default this filter will not modify or drop any messages, but it will log all messages that are 24 hours older or newer than current time.

Constant Summary collapse

CUTOFF_ACTIONS =

Available actions for messages.

[
  # Pass record as is:
  :pass,
  # Replace time with "now" and pass:
  :replace_timestamp,
  # Drop record as invalid:
  :drop
].freeze
TIME_FORMATS =

Available time formats for :replace_timestamp action.

[
  # UNIX time (integer)
  :epoch,
  # UNIX time (float)
  :epoch_float,
  # ISO 8601 datetime (string)
  :iso8601
].freeze
TIME_ISO8601 =

strftime() format string for :iso8601 time format.

'%FT%T%:z'

Instance Method Summary collapse

Instance Method Details

#filter_with_time(tag, time, record) ⇒ Object 



56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/fluent/plugin/filter_time_cutoff.rb', line 56

def filter_with_time(tag, time, record)
  event_time = time.to_i
  current_time = Time.now.to_i

  if event_time < current_time - @old_cutoff
    # Too old
    process_old_record(tag, time, record)
  elsif event_time > current_time + @new_cutoff
    # Too new
    process_new_record(tag, time, record)
  else
    # OK
    [time, record]
  end
end