Class: LogStash::Codecs::Cloudfront

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/codecs/cloudfront.rb

Overview

This codec will read cloudfront encoded content

Instance Method Summary collapse

Constructor Details

#initialize(params = {}) ⇒ Cloudfront

Returns a new instance of Cloudfront.



23
24
25
26
27
 
# File 'lib/logstash/codecs/cloudfront.rb', line 23

def initialize(params={})
  super(params)
  @converter = LogStash::Util::Charset.new(@charset)
  @converter.logger = @logger
end

Instance Method Details

#create_event(line, metadata) ⇒ Object 



51
52
53
54
55
56
 
# File 'lib/logstash/codecs/cloudfront.rb', line 51

def create_event(line, metadata)
  event = LogStash::Event.new("message" => @converter.convert(line))
  event.set("cloudfront_version", metadata["cloudfront_version"])
  event.set("cloudfront_fields", metadata["cloudfront_fields"])
  event
end

#decode(data) ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/logstash/codecs/cloudfront.rb', line 30

def decode(data)
  begin
    @gzip = Zlib::GzipReader.new(data)

    metadata = extract_metadata(@gzip)

    @logger.debug("Cloudfront: Extracting metadata", :metadata => metadata)

    @gzip.each_line do |line|
      yield create_event(line, metadata)
    end

  rescue Zlib::Error, Zlib::GzipFile::Error=> e
    file = data.is_a?(String) ? data : data.class

    @logger.error("Cloudfront codec: We cannot uncompress the gzip file", :filename => file)
    raise e
  end
end

#extract_fields(line) ⇒ Object 



78
79
80
81
82
83
 
# File 'lib/logstash/codecs/cloudfront.rb', line 78

def extract_fields(line)
  if /^#Fields: .+/.match(line)
    junk, format = line.strip().split(/#Fields: (.+)/)
    format unless format.nil?
  end
end

#extract_metadata(io) ⇒ Object 



59
60
61
62
63
64
65
66
67
 
# File 'lib/logstash/codecs/cloudfront.rb', line 59

def extract_metadata(io)
  version = extract_version(io.gets)
  fields = extract_fields(io.gets)

  return {
    "cloudfront_version" => version,
    "cloudfront_fields" => fields,
  }
end

#extract_version(line) ⇒ Object 



70
71
72
73
74
75
 
# File 'lib/logstash/codecs/cloudfront.rb', line 70

def extract_version(line)
  if /^#Version: .+/.match(line)
    junk, version = line.strip().split(/#Version: (.+)/)
    version unless version.nil?
  end
end