Class: LogStash::Filters::Split

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/split.rb

Overview

The split filter clones an event by splitting one of its fields and placing each value resulting from the split into a clone of the original event. The field being split can either be a string or an array.

An example use case of this filter is for taking output from the <<plugins-inputs-exec,exec input plugin>> which emits one event for the whole output of a command and splitting that output by newline - making each line an event.

The end result of each split is a complete copy of the event with only the current split section of the given field changed.

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/logstash/filters/split.rb', line 37

def filter(event)
  

  original_value = event.get(@field)

  if original_value.is_a?(Array)
    splits = original_value
  elsif original_value.is_a?(String)
    # Using -1 for 'limit' on String#split makes ruby not drop trailing empty
    # splits.
    splits = original_value.split(@terminator, -1)
  else
    raise LogStash::ConfigurationError, "Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}"
  end

  # Skip filtering if splitting this event resulted in only one thing found.
  return if splits.length == 1 && original_value.is_a?(String)
  #or splits[1].empty?

  splits.each do |value|
    next if value.empty?

    event_split = event.clone
    @logger.debug("Split event", :value => value, :field => @field)
    if @target.nil?
      event_split.set(@field, value)
    else
      event_split.set(@target, value)
    end
    filter_matched(event_split)

    # Push this new event onto the stack at the LogStash::FilterWorker
    yield event_split
  end

  # Cancel this event, we'll use the newly generated ones above.
  event.cancel
end

#register ⇒ Object 



32
33
34
 
# File 'lib/logstash/filters/split.rb', line 32

def register
  # Nothing to do
end