Class: LogStash::Filters::Split

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/split.rb

Overview

The split filter is for splitting multiline messages into separate events.

An example use case of this filter is for taking output from the exec input which emits one event for the whole output of a command and splitting that output by newline - making each line an event.

The end result of each split is a complete copy of the event with only the current split section of the given field changed.

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/logstash/filters/split.rb', line 34

def filter(event)
  return unless filter?(event)

  original_value = event[@field]

  if original_value.is_a?(Array)
    splits = original_value
  elsif original_value.is_a?(String)
    # Using -1 for 'limit' on String#split makes ruby not drop trailing empty
    # splits.
    splits = original_value.split(@terminator, -1)
  else
    raise LogStash::ConfigurationError, "Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}"
  end

  # Skip filtering if splitting this event resulted in only one thing found.
  return if splits.length == 1
  #or splits[1].empty?

  splits.each do |value|
    next if value.empty?

    event_split = event.clone
    @logger.debug("Split event", :value => value, :field => @field)
    event_split[(@target || @field)] = value
    filter_matched(event_split)

    # Push this new event onto the stack at the LogStash::FilterWorker
    yield event_split
  end

  # Cancel this event, we'll use the newly generated ones above.
  event.cancel
end

#register ⇒ Object 



29
30
31
 
# File 'lib/logstash/filters/split.rb', line 29

def register
  # Nothing to do
end