Class: LogStash::Codecs::OldLogStashJSON

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/codecs/oldlogstashjson.rb

Constant Summary collapse

V0_TO_V1 =

Map from v0 name to v1 name. Note: @source is gone and has no similar field.

{"@timestamp" => "@timestamp", "@message" => "message",
"@tags" => "tags", "@type" => "type",
"@source_host" => "host", "@source_path" => "path"}

Instance Method Summary collapse

Instance Method Details

#decode(data) {|LogStash::Event.new(h)| ... } ⇒ Object

Yields:

  • (LogStash::Event.new(h)) 


15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/logstash/codecs/oldlogstashjson.rb', line 15

def decode(data)
  begin
    obj = LogStash::Json.load(data.force_encoding(Encoding::UTF_8))
  rescue LogStash::Json::ParserError => e
    @logger.info("JSON parse failure. Falling back to plain-text", :error => e, :data => data)
    yield LogStash::Event.new("message" => data)
    return
  end

  h  = {}

  # Convert the old logstash schema to the new one.
  V0_TO_V1.each do |key, val|
    h[val] = obj[key] if obj.include?(key)
  end

  h.merge!(obj["@fields"]) if obj["@fields"].is_a?(Hash)
  yield LogStash::Event.new(h)
end

#encode(event) ⇒ Object 



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/logstash/codecs/oldlogstashjson.rb', line 36

def encode(event)
  h  = {}

  # Convert the new logstash schema to the old one.
  V0_TO_V1.each do |key, val|
    h[key] = event[val] if event.include?(val)
  end

  event.to_hash.each do |field, val|
    # TODO: might be better to V1_TO_V0 = V0_TO_V1.invert during
    # initialization than V0_TO_V1.has_value? within loop
    next if field == "@version" or V0_TO_V1.has_value?(field)
    h["@fields"] ||= {}
    h["@fields"][field] = val
  end

  # Tack on a \n because JSON outputs 1.1.x had them.
  @on_event.call(event, LogStash::Json.dump(h) + NL)
end