Class: LogStash::Filters::Alter

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/alter.rb

Overview

The alter filter allows you to do general alterations to fields that are not included in the normal mutate filter.

NOTE: The functionality provided by this plugin is likely to be merged into the ‘mutate’ filter in future versions.

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



104
105
106
107
108
109
110
111
112
 
# File 'lib/logstash/filters/alter.rb', line 104

def filter(event)
  

  condrewrite(event) if @condrewrite
  condrewriteother(event) if @condrewriteother
  coalesce(event) if @coalesce

  filter_matched(event)
end

#register ⇒ Object 



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
 
# File 'lib/logstash/filters/alter.rb', line 61

def register 
  @condrewrite_parsed = []
  @condrewrite.nil? or @condrewrite.each_slice(3) do |field, expected, replacement|
    if [field, expected, replacement].any? {|n| n.nil?}
      @logger.error("Invalid condrewrte configuration. condrewrite has to define 3 elements per config entry", :field => field, :expected => expected, :replacement => replacement)
      raise "Bad configuration, aborting."
    end
    @condrewrite_parsed << {
      :field        => field,
      :expected       => expected,
      :replacement  => replacement
    }
  end # condrewrite
  
  @condrewriteother_parsed = []
  @condrewriteother.nil? or @condrewriteother.each_slice(4) do |field, expected, replacement_field, replacement_value|
    if [field, expected, replacement_field, replacement_value].any? {|n| n.nil?}
      @logger.error("Invalid condrewrteother configuration. condrewriteother has to define 4 elements per config entry", :field => field, :expected => expected, :replacement_field => replacement_field, :replacement_value => replacement_value)
      raise "Bad configuration, aborting."
    end
    @condrewriteother_parsed << {
      :field        => field,
      :expected       => expected,
      :replacement_field  => replacement_field,
      :replacement_value => replacement_value
    }
  end # condrewriteother
  
  @coalesce_parsed = []
  @coalesce.nil? or if not @coalesce.is_a?(Array) or @coalesce.length < 2
    @logger.error("Invalid coalesce configuration. coalesce has to define one Array of at least 2 elements")
    raise "Bad configuration, aborting."
  else
    @coalesce_parsed << {
      :field  => @coalesce.slice!(0),
      :subst_array => @coalesce
    }
  end


end