Class: Grok

Inherits:
FFI::Struct
  • Object
show all
Includes:
CGrok
Defined in:
lib/grok.rb,
lib/grok-pure.rb,
lib/grok/pure/pile.rb,
lib/grok/c-ext/pile.rb

Overview

A grok pile is an easy way to have multiple patterns together so that you can try to match against each one. The API provided should be similar to the normal Grok interface, but you can compile multiple patterns and match will try each one until a match is found.

Defined Under Namespace

Modules: CGrok Classes: Match, Pile

Constant Summary collapse

GROK_OK = 
0
GROK_ERROR_FILE_NOT_ACCESSIBLE = 
1
GROK_ERROR_PATTERN_NOT_FOUND = 
2
GROK_ERROR_UNEXPECTED_READ_SIZE = 
3
GROK_ERROR_COMPILE_FAILED = 
4
GROK_ERROR_UNINITIALIZED = 
5
GROK_ERROR_PCRE_ERROR = 
6
GROK_ERROR_NOMATCH = 
7
PATTERN_RE = 
/%\{    # match '%{' not prefixed with '\'
  (?<name>     # match the pattern name
    (?<pattern>[A-z0-9]+)
    (?::(?<subname>[A-z0-9_:]+))?
  )
  (?:=(?<definition>
    (?:
      (?:[^{}\\]+|\\.+)+
      |
      (?<curly>\{(?:(?>[^{}]+|(?>\\[{}])+)|(\g<curly>))*\})+
    )+
  ))?
  [^}]*
\}/x

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Grok

Returns a new instance of Grok.



49
50
51
 
# File 'lib/grok.rb', line 49

def initialize
  super(grok_new)
end

Instance Attribute Details

#expanded_pattern ⇒ Object

Returns the value of attribute expanded_pattern.



77
78
79
 
# File 'lib/grok.rb', line 77

def expanded_pattern
  return self[:full_pattern]
end

#logger ⇒ Object

Returns the value of attribute logger.



9
10
11
 
# File 'lib/grok-pure.rb', line 9

def logger
  @logger
end

#pattern ⇒ Object

Returns the value of attribute pattern.



72
73
74
 
# File 'lib/grok.rb', line 72

def pattern
  return self[:pattern]
end

Instance Method Details

#add_pattern(name, pattern) ⇒ Object 



54
55
56
57
58
59
 
# File 'lib/grok.rb', line 54

def add_pattern(name, pattern)
  name_c = FFI::MemoryPointer.from_string(name)
  pattern_c = FFI::MemoryPointer.from_string(pattern)
  grok_pattern_add(self, name_c, name.length, pattern_c, pattern.length)
  return nil
end

#add_patterns_from_file(path) ⇒ Object 



62
63
64
65
66
67
68
69
 
# File 'lib/grok.rb', line 62

def add_patterns_from_file(path)
  path_c = FFI::MemoryPointer.from_string(path)
  ret = grok_patterns_import_from_file(self, path_c)
  if ret != GROK_OK
    raise ArgumentError, "Failed to add patterns from file #{path}"
  end
  return nil
end

#capture_name(id) ⇒ Object 



139
140
141
 
# File 'lib/grok-pure.rb', line 139

def capture_name(id)
  return @capture_map[id]
end

#compile(pattern) ⇒ Object 



82
83
84
85
86
87
88
89
 
# File 'lib/grok.rb', line 82

def compile(pattern)
  pattern_c = FFI::MemoryPointer.from_string(pattern)
  ret = grok_compilen(self, pattern_c, pattern.length)
  if ret != GROK_OK
    raise ArgumentError, "Compile failed: #{self[:errstr]})"
  end
  return ret
end

#discover(input) ⇒ Object 



119
120
121
122
123
 
# File 'lib/grok.rb', line 119

def discover(input)
  init_discover if @discover == nil

  return @discover.discover(input)
end

#match(text) ⇒ Object

Raises:

  • (ValueError) 


92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'lib/grok.rb', line 92

def match(text)
  match = Grok::Match.new
  text_c = FFI::MemoryPointer.from_string(text)
  rc = grok_execn(self, text_c, text.size, match)
  case rc
  when GROK_OK
    # Give the Grok::Match object a reference to the 'text_c'
    # object which is also Grok::Match#subject string;
    # this will prevent Ruby from garbage collecting it until
    # the match object is garbage collectd.
    #
    # If we don't do this, then 'text_c' will fall out of
    # scope at the end of this function and become a candidate
    # for garbage collection, causing Grok::Match#subject to become
    # corrupt and any captures to point to those corrupt portions.
    # http://code.google.com/p/logstash/issues/detail?id=47
    match.subject_memorypointer = text_c

    return match
  when GROK_ERROR_NOMATCH
    return false
  end

  raise ValueError, "unknown return from grok_execn: #{rc}"
end