Class: LogStash::Filters::Ruby

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/ruby.rb

Overview

Execute ruby code.

For example, to cancel 90% of events, you can do this:

source,ruby

filter {

ruby {
  # Cancel 90% of events
  code => "event.cancel if rand <= 0.90"
}

}

If you need to create additional events, it cannot be done as in other filters where you would use ‘yield`, you must use a specific syntax `new_event_block.call(event)` like in this example duplicating the input event

source,ruby

filter {

ruby {
  code => "new_event_block.call(event.clone)"
}

}

Defined Under Namespace

Classes: ScriptError

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(*params) ⇒ Ruby

Returns a new instance of Ruby.



51
52
53
54
55
56
57
58
 
# File 'lib/logstash/filters/ruby.rb', line 51

def initialize(*params)
  super(*params)
  if @path # run tests on the ruby file script
    @script = Script.new(@path, @script_params)
    @script.load
    @script.test
  end
end

Class Method Details

.check_result_events!(results) ⇒ Object 



74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/logstash/filters/ruby.rb', line 74

def self.check_result_events!(results)
  if !results.is_a?(Array)
    raise "Custom script did not return an array from 'filter'. Only arrays may be returned!"
  end

  results.each do |r_event|
    if !r_event.is_a?(::LogStash::Event)
      raise "Custom script returned a non event object '#{r_event.inspect}'!" +
            " You must an array of events from this function! To drop an event simply return nil."
    end
  end
end

Instance Method Details

#file_script(event) ⇒ Object 



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'lib/logstash/filters/ruby.rb', line 108

def file_script(event)
  begin
    results = @script.execute(event)
    filter_matched(event)

    self.class.check_result_events!(results)
  rescue => e
    if @tag_with_exception_message
      event.tag("#{@tag_on_exception}: #{e}")
    end
    event.tag(@tag_on_exception)
    message = "Could not process event: " + e.message
    @logger.error(message, :script_path => @path,
                           :class => e.class.name,
                           :backtrace => e.backtrace)
    return event
  end

  returned_original = false
  results.each do |r_event|
    # If the user has generated a new event we yield that for them here
    if event == r_event
      returned_original = true
    else
      yield r_event
    end

    r_event
  end

  event.cancel unless returned_original
end

#filter(event, &block) ⇒ Object 



87
88
89
90
91
92
93
 
# File 'lib/logstash/filters/ruby.rb', line 87

def filter(event, &block)
  if @code
    inline_script(event, &block)
  elsif @path
    file_script(event, &block)
  end
end

#inline_script(event, &block) ⇒ Object 



95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/logstash/filters/ruby.rb', line 95

def inline_script(event, &block)
  filter_method(event, &block)
  filter_matched(event)
rescue Exception => e
  @logger.error("Ruby exception occurred: #{e.message}",
                :class     => e.class.name,
                :backtrace => e.backtrace)
  if @tag_with_exception_message
    event.tag("#{@tag_on_exception}: #{e}")
  end
  event.tag(@tag_on_exception)
end

#register ⇒ Object 



60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/logstash/filters/ruby.rb', line 60

def register
  if @code && @path.nil?
    eval(@init, binding, "(ruby filter init)") if @init
    eval("define_singleton_method :filter_method do |event, &new_event_block|\n #{@code} \nend", binding, "(ruby filter code)")
  elsif @path && @code.nil?
    @script.register
  else
    @logger.fatal("You must either use an inline script with the \"code\" option or a script file using \"path\".")
  end
rescue ::ScriptError => e # SyntaxError, LoadError etc.
  @logger.error("error in register", message: e.message, exception: e.class, backtrace: e.backtrace)
  fail("unexpected error: #{e}")
end