class Fluent::Plugin::ECSMetadataFilter

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 19
def configure(conf)
  super

  require 'fluent_ecs'

  validate_params

  FluentECS.configure do |c|
    c.cache_size = @cache_size
    c.cache_ttl  = @cache_ttl < 0 ? :none : @cache_ttl
    c.fields     = @fields
  end

  @tag_regexp_compiled = Regexp.compile(@tag_regexp)
end
filter_stream(tag, es) click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 35
def filter_stream(tag, es)
  new_es   = Fluent::MultiEventStream.new
  metadata = metadata_for_tag(tag)

  es.each do |time, record|
    if metadata
      record = merge_log_json(record) if merge_json_logs?
      record['ecs'] = metadata.to_h
    end

    new_es.add(time, record)
  end

  new_es
end
looks_like_json?(str) click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 64
def looks_like_json?(str)
  str.is_a?(String) && str[0] == '{' && str[-1] == '}'
end
merge_json_logs?() click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 68
def merge_json_logs?
  @merge_json_log
end
merge_log_json(record) click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 72
def merge_log_json(record)
  log = record['log']
  if looks_like_json?(log)
    begin
      record = JSON.parse(log).merge!(record)
      record.delete('log')
    rescue JSON::ParserError => e
      self.log.error(e)
    end
  end

  record
end
metadata_for_tag(tag) click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 56
def metadata_for_tag(tag)
  match = tag.match(@tag_regexp_compiled)
  FluentECS::Container.find(match['docker_id']) unless match.nil?
rescue FluentECS::IntrospectError => e
  log.error(e)
  nil
end
validate_params() click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 51
def validate_params
  bad_field = @fields.find { |f| !FluentECS::Container.method_defined?(f) }
  raise Fluent::ConfigError, "Invalid field: '#{bad_field}'" if bad_field
end