Class: LogStash::Filters::FieldMap

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/fieldmap.rb

Overview

This filter will split the src_field on delimiter and then create a map in the dst_field by pairing the elements of the keys config item with the values from the split src field.

If the number of elements in the split src_field and the supplied keys is not the same the event will receive a tag and be sent along

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/logstash/filters/fieldmap.rb', line 51

def filter(event)
@logger.debug? and @logger.debug("Running fieldmap filter", :event => event)

  if event[@src_field]
    #  split the src field on delimiter then check if that length matches
    #  the key lenght, if not, explode
    split_src = event[@src_field].split(/#{@regex}/)
    @logger.debug? and @logger.debug("split_src is: ", :split_src => split_src)
    if split_src.length == @keys.length
      event[@dst_field] = {}  #  don't need to save off the source data, already split into split_src
      idx = 0
      split_src.map do |val| 
        val = val.strip
        if val.include?('{')
          begin
            val = LogStash::Json.load(val.gsub("\\", ""))
          rescue LogStash::Json::ParserError  # if its not valid json leave it alone
          end
        end
        event[@dst_field][@keys[idx]] = val 
        idx=idx+1
      end
      filter_matched(event)
    else
      event["tags"] ||= []
      event["tags"] << @map_failure unless event["tags"].include?(@map_failure)
      @logger.info? and @logger.info("Event failed field map")
    end
  end

@logger.debug? and @logger.debug("Event now: ", :event => event)

end

#register ⇒ Object 



46
47
48
 
# File 'lib/logstash/filters/fieldmap.rb', line 46

def register
  # Add instance variables 
end