class LogStash::Filters::Date
Public Class Methods
new(config = {})
click to toggle source
The 'date' filter will take a value from your event and use it as the event timestamp. This is useful for parsing logs generated on remote servers or for importing old logs.
The config looks like this:
filters:
date: <type>: <fieldname>: <format> <type> <fieldname>: <format>
The format is whatever is supported by Ruby's DateTime.strptime
Calls superclass method
LogStash::Filters::Base::new
# File lib/logstash/filters/date.rb, line 21 def initialize(config = {}) super @types = Hash.new { |h,k| h[k] = [] } end
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/date.rb, line 37 def filter(event) @logger.debug "DATE FILTER: received event of type #{event.type}" return unless @types.member?(event.type) @types[event.type].each do |field, format| @logger.debug "DATE FILTER: type #{event.type}, looking for field #{field.inspect} with format #{format.inspect}" # TODO(sissel): check event.message, too. if event.fields.member?(field) fieldvalue = event.fields[field] fieldvalue = [fieldvalue] if fieldvalue.is_a?(String) fieldvalue.each do |value| next if value == "" begin case format when "ISO8601" time = DateTime.parse(value) else time = DateTime.strptime(value, format) end event.timestamp = LogStash::Time.to_iso8601(time) @logger.debug "Parsed #{value.inspect} as #{event.timestamp}" rescue => e @logger.warn "Failed parsing date #{value.inspect} from field #{field} with format #{format.inspect}: #{e}" end end # fieldvalue.each end # if this event has a field we expect to be a timestamp end # @types[event.type].each end
register()
click to toggle source
# File lib/logstash/filters/date.rb, line 28 def register @config.each do |type, typeconfig| @logger.debug "Setting type #{type.inspect} to the config #{typeconfig.inspect}" raise "date filter type \"#{type}\" defined more than once" unless @types[type].empty? @types[type] = typeconfig end # @config.each end