class LogStash::Codecs::Cloudfront
This codec will read cloudfront encoded content
Public Class Methods
new(params={})
click to toggle source
Calls superclass method
# File lib/logstash/codecs/cloudfront.rb, line 23 def initialize(params={}) super(params) @converter = LogStash::Util::Charset.new(@charset) @converter.logger = @logger end
Public Instance Methods
create_event(line, metadata)
click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 51 def create_event(line, metadata) event = LogStash::Event.new("message" => @converter.convert(line)) event.set("cloudfront_version", metadata["cloudfront_version"]) event.set("cloudfront_fields", metadata["cloudfront_fields"]) event end
decode(data) { |create_event(line, metadata)| ... }
click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 30 def decode(data) begin @gzip = Zlib::GzipReader.new(data) metadata = extract_metadata(@gzip) @logger.debug("Cloudfront: Extracting metadata", :metadata => metadata) @gzip.each_line do |line| yield create_event(line, metadata) end rescue Zlib::Error, Zlib::GzipFile::Error=> e file = data.is_a?(String) ? data : data.class @logger.error("Cloudfront codec: We cannot uncompress the gzip file", :filename => file) raise e end end
extract_fields(line)
click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 78 def extract_fields(line) if /^#Fields: .+/.match(line) junk, format = line.strip().split(/#Fields: (.+)/) format unless format.nil? end end
extract_metadata(io)
click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 59 def extract_metadata(io) version = extract_version(io.gets) fields = extract_fields(io.gets) return { "cloudfront_version" => version, "cloudfront_fields" => fields, } end
extract_version(line)
click to toggle source
# File lib/logstash/codecs/cloudfront.rb, line 70 def extract_version(line) if /^#Version: .+/.match(line) junk, version = line.strip().split(/#Version: (.+)/) version unless version.nil? end end