Class: LogStash::Inputs::Beats::EventTransformCommon

Inherits:
Object
  • Object
show all
Defined in:
lib/logstash/inputs/beats/event_transform_common.rb

Overview

Base Transform class, expose the plugin decorate method, apply the tags and make sure we copy the beat hostname into host for backward compatibility.

Direct Known Subclasses

DecodedEventTransform, RawEventTransform

Instance Method Summary collapse

Constructor Details

#initialize(input) ⇒ EventTransformCommon

Returns a new instance of EventTransformCommon.



7
8
9
10
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 7

def initialize(input)
  @input = input
  @logger = input.logger
end

Instance Method Details

#codec_name ⇒ Object 



35
36
37
38
39
40
41
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 35

def codec_name
  @codec_name ||= if @input.codec.respond_to?(:base_codec)
                    @input.codec.base_codec.class.config_name
                  else
                    @input.codec.class.config_name
                  end
end

#copy_beat_hostname(event) ⇒ Object

Copies the beat.hostname field into the host field unless the host field is already defined



14
15
16
17
18
19
20
21
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 14

def copy_beat_hostname(event)
  return unless @input.add_hostname
  host = event.get("[beat][hostname]")

  if host && event.get(@input.field_hostname).nil?
    event.set(@input.field_hostname, host)
  end
end

#decorate(event) ⇒ Object

This break the #decorate method visibility of the plugin base class, the method is protected and we cannot access it, but well ruby can let you do all the wrong thing.

I think the correct behavior would be to allow the plugin to return a Decorator object that we can pass to other objects, since only the plugin know the data used to decorate. This would allow a more component based workflow.



31
32
33
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 31

def decorate(event)
  @input.send(:decorate, event)
end

#include_codec_tag? ⇒ Boolean

Returns:

  • (Boolean) 


49
50
51
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 49

def include_codec_tag?
  @input.include_codec_tag
end

#transform(event) ⇒ Object 



43
44
45
46
47
 
# File 'lib/logstash/inputs/beats/event_transform_common.rb', line 43

def transform(event)
  copy_beat_hostname(event)
  decorate(event)
  event
end