Class: LogStash::Inputs::Beats::DecodedEventTransform

Inherits:
EventTransformCommon show all
Defined in:
lib/logstash/inputs/beats/decoded_event_transform.rb

Overview

Take the extracted content from the codec, merged with the other data coming from beats, apply the configured tags, normalize the host and try to coerce the timestamp if it was provided in the hash.

Instance Method Summary collapse

Methods inherited from EventTransformCommon

#codec_name, #copy_beat_hostname, #decorate, #include_codec_tag?, #initialize

Constructor Details

This class inherits a constructor from LogStash::Inputs::Beats::EventTransformCommon

Instance Method Details

#transform(event, hash) ⇒ Object 



8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/logstash/inputs/beats/decoded_event_transform.rb', line 8

def transform(event, hash)
  ts = coerce_ts(hash.delete("@timestamp"))

  event.set("@timestamp", ts) unless ts.nil?
  hash.each do |k, v|
    #could be a nested map, so we need to merge and not overwrite
    existing_value = event.get(k)
    if existing_value.is_a?(Hash)
      existing_value = existing_value.merge(v)
    else
      existing_value = v
    end
    event.set(k, existing_value)
  end
  super(event)
  event.tag("beats_input_codec_#{codec_name}_applied") if include_codec_tag?
  event
end