class LogStash::Filters::Ruby

Execute ruby code.

For example, to cancel 90% of events, you can do this:

source,ruby

filter {

ruby {
  # Cancel 90% of events
  code => "event.cancel if rand <= 0.90"
}

}

If you need to create additional events, it cannot be done as in other filters where you would use `yield`, you must use a specific syntax `new_event_block.call(event)` like in this example duplicating the input event

source,ruby

filter {

ruby {
  code => "new_event_block.call(event.clone)"
}

}

Public Class Methods

check_result_events!(results) click to toggle source
# File lib/logstash/filters/ruby.rb, line 71
def self.check_result_events!(results)
  if !results.is_a?(Array)
    raise "Custom script did not return an array from 'filter'. Only arrays may be returned!"
  end

  results.each do |r_event|
    if !r_event.is_a?(::LogStash::Event)
      raise "Custom script returned a non event object '#{r_event.inspect}'!" +
            " You must an array of events from this function! To drop an event simply return nil."
    end
  end
end
new(*params) click to toggle source
Calls superclass method
# File lib/logstash/filters/ruby.rb, line 51
def initialize(*params)
  super(*params)
  if @path # run tests on the ruby file script
    @script = Script.new(@path, @script_params)
    @script.load
    @script.test
  end
end

Public Instance Methods

file_script(event) { |r_event| ... } click to toggle source
# File lib/logstash/filters/ruby.rb, line 105
def file_script(event)
  begin
    results = @script.execute(event)
    filter_matched(event)

    self.class.check_result_events!(results)
  rescue => e
    if @tag_with_exception_message
      event.tag("#{@tag_on_exception}: #{e}")
    end
    event.tag(@tag_on_exception)
    message = "Could not process event: " + e.message
    @logger.error(message, :script_path => @path,
                           :class => e.class.name,
                           :backtrace => e.backtrace)
    return event
  end

  returned_original = false
  results.each do |r_event|
    # If the user has generated a new event we yield that for them here
    if event == r_event
      returned_original = true
    else
      yield r_event
    end

    r_event
  end

  event.cancel unless returned_original
end
filter(event, &block) click to toggle source
# File lib/logstash/filters/ruby.rb, line 84
def filter(event, &block)
  if @code
    inline_script(event, &block)
  elsif @path
    file_script(event, &block)
  end
end
inline_script(event, &block) click to toggle source
# File lib/logstash/filters/ruby.rb, line 92
def inline_script(event, &block)
  filter_method(event, &block)
  filter_matched(event)
rescue Exception => e
  @logger.error("Ruby exception occurred: #{e.message}",
                :class     => e.class.name,
                :backtrace => e.backtrace)
  if @tag_with_exception_message
    event.tag("#{@tag_on_exception}: #{e}")
  end
  event.tag(@tag_on_exception)
end
register() click to toggle source
# File lib/logstash/filters/ruby.rb, line 60
def register
  if @code && @path.nil?
    eval(@init, binding, "(ruby filter init)") if @init
    eval("define_singleton_method :filter_method do |event, &new_event_block|\n #{@code} \nend", binding, "(ruby filter code)")
  elsif @path && @code.nil?
    @script.register
  else
    @logger.fatal("You must either use an inline script with the \"code\" option or a script file using \"path\".")
  end
end