class LogStash::Codecs::Cloudfront

This codec will read cloudfront encoded content

Public Class Methods

new(params={}) click to toggle source
Calls superclass method
# File lib/logstash/codecs/cloudfront.rb, line 23
def initialize(params={})
  super(params)
  @converter = LogStash::Util::Charset.new(@charset)
  @converter.logger = @logger
end

Public Instance Methods

create_event(line, metadata) click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 51
def create_event(line, metadata)
  event = LogStash::Event.new("message" => @converter.convert(line))
  event.set("cloudfront_version", metadata["cloudfront_version"])
  event.set("cloudfront_fields", metadata["cloudfront_fields"])
  event
end
decode(data) { |create_event(line, metadata)| ... } click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 30
def decode(data)
  begin
    @gzip = Zlib::GzipReader.new(data)

    metadata = extract_metadata(@gzip)

    @logger.debug("Cloudfront: Extracting metadata", :metadata => metadata)

    @gzip.each_line do |line|
      yield create_event(line, metadata)
    end

  rescue Zlib::Error, Zlib::GzipFile::Error=> e
    file = data.is_a?(String) ? data : data.class

    @logger.error("Cloudfront codec: We cannot uncompress the gzip file", :filename => file)
    raise e
  end
end
extract_fields(line) click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 78
def extract_fields(line)
  if /^#Fields: .+/.match(line)
    junk, format = line.strip().split(/#Fields: (.+)/)
    format unless format.nil?
  end
end
extract_metadata(io) click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 59
def extract_metadata(io)
  version = extract_version(io.gets)
  fields = extract_fields(io.gets)

  return {
    "cloudfront_version" => version,
    "cloudfront_fields" => fields,
  }
end
extract_version(line) click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 70
def extract_version(line)
  if /^#Version: .+/.match(line)
    junk, version = line.strip().split(/#Version: (.+)/)
    version unless version.nil?
  end
end