Class: LogStash::Filters::Augment

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/augment.rb

Overview

This filter will allow you to augment events in logstash from an external file source

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/logstash/filters/augment.rb', line 157

def filter(event)
  load_or_refresh_dictionaries(false)

  return unless event.include?(@field) # Skip translation in case event does not have @event field.

  begin
    #If source field is array use first value and make sure source value is string
    source = event.get(@field).is_a?(Array) ? event.get(@field).first.to_s : event.get(@field).to_s
    row = lock_for_read { @dictionary[source] }
    if !row
      row = @default
    end
    return unless row # nothing to do if there's nothing to add

    if @only_fields
      only_fields.each { |k| event.set("#{@target}[#{k}]",row[v]) if row[v] }
    else
      row.each { |k,v| event.set("#{@target}[#{k}]",v) unless @exclude_keys[k] }
    end
    filter_matched(event)
  rescue Exception => e
    @logger.error("Something went wrong when attempting to augment from dictionary", :exception => e, :field => @field, :event => event)
  end
end

#register ⇒ Object 



113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/logstash/filters/augment.rb', line 113

def register
  @fileModifiedTime = Hash.new
  rw_lock = java.util.concurrent.locks.ReentrantReadWriteLock.new
  @read_lock = rw_lock.readLock
  @write_lock = rw_lock.writeLock
  if !@dictionary
    @dictionary = Hash.new
  end
  @dictionaries = @dictionary_path.nil? ? nil : (@dictionary_path.is_a?(Array) ? @dictionary_path : [ @dictionary_path ])

  if @dictionary_path && !@dictionary.empty?
    raise LogStash::ConfigurationError, "The configuration options 'dictionary' and 'dictionary_path' are mutually exclusive"
  end

  if @csv_ignore_first_line && !@csv_header
    raise LogStash::ConfigurationError, "The parameter csv_header is required if csv_ignore_first_line = true"
  end

  load_or_refresh_dictionaries(true)

  @exclude_keys = Hash.new
  if @ignore_fields
    @ignore_fields.each { |k| @exclude_keys[k]=true }
  end

  # validate the dictionary is in the right format
  if @dictionary
    newdic = Hash.new
    @dictionary.each do |key,val|
      if val.is_a?(Array)
        newdic[key] = Hash[*val]
      elsif val.is_a?(Hash)
        newdic[key] = val
      else
        raise LogStash::ConfigurationError, "The dictionary must be a hash of string to dictionary.  "+key+" is neither a "+val.class.to_s
      end
    end
    @dictionary = newdic
  end

  @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
end