class LogStash::Filters::Esquerystring

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/esquerystring.rb, line 19
def filter(event)
  values = []

  @source.each do |field|
    next unless event.include?(field)
    value = event.get(field)
    next if value.nil?
    value = [value] unless value.is_a?(Array)
    next if value.length == 0
    values += value
  end

  values.compact!

  return if values.length == 0
  values = values.uniq.map { |x| '"' + x + '"' }
  values_str = "(" + values.join(" OR ") + ")"
  if values_str.length > @maxlength
    msg = "Produced too long query string (>#{@maxlength}): #{values_str}"
    if @length_autofix
      while values_str.length > @maxlength
        values.pop
        values_str = "(" + values.join(" OR ") + ")"
      end
      @logger.warn(msg + "; Autofixed to: #{values_str}")
      event.set(@target, values_str)
    else
      @logger.error(msg)
    end
  else
    event.set(@target, values_str)
  end
end
register() click to toggle source
# File lib/logstash/filters/esquerystring.rb, line 14
def register
  # Nothing to do
end