class LogStash::Filters::Alter

The alter filter allows you to do general alterations to fields that are not included in the normal mutate filter.

NOTE: The functionality provided by this plugin is likely to be merged into the 'mutate' filter in future versions.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/alter.rb, line 104
def filter(event)
  

  condrewrite(event) if @condrewrite
  condrewriteother(event) if @condrewriteother
  coalesce(event) if @coalesce

  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/alter.rb, line 61
def register 
  @condrewrite_parsed = []
  @condrewrite.nil? or @condrewrite.each_slice(3) do |field, expected, replacement|
    if [field, expected, replacement].any? {|n| n.nil?}
      @logger.error("Invalid condrewrte configuration. condrewrite has to define 3 elements per config entry", :field => field, :expected => expected, :replacement => replacement)
      raise "Bad configuration, aborting."
    end
    @condrewrite_parsed << {
      :field        => field,
      :expected       => expected,
      :replacement  => replacement
    }
  end # condrewrite
  
  @condrewriteother_parsed = []
  @condrewriteother.nil? or @condrewriteother.each_slice(4) do |field, expected, replacement_field, replacement_value|
    if [field, expected, replacement_field, replacement_value].any? {|n| n.nil?}
      @logger.error("Invalid condrewrteother configuration. condrewriteother has to define 4 elements per config entry", :field => field, :expected => expected, :replacement_field => replacement_field, :replacement_value => replacement_value)
      raise "Bad configuration, aborting."
    end
    @condrewriteother_parsed << {
      :field        => field,
      :expected       => expected,
      :replacement_field  => replacement_field,
      :replacement_value => replacement_value
    }
  end # condrewriteother
  
  @coalesce_parsed = []
  @coalesce.nil? or if not @coalesce.is_a?(Array) or @coalesce.length < 2
    @logger.error("Invalid coalesce configuration. coalesce has to define one Array of at least 2 elements")
    raise "Bad configuration, aborting."
  else
    @coalesce_parsed << {
      :field  => @coalesce.slice!(0),
      :subst_array => @coalesce
    }
  end


end

Private Instance Methods

coalesce(event) click to toggle source
# File lib/logstash/filters/alter.rb, line 163
def coalesce(event)
  @coalesce_parsed.each do |config|
    field = config[:field]
    subst_array = config[:subst_array]
    
    substitution_parsed = subst_array.map { |x| event.sprintf(x) }
    not_nul_index = substitution_parsed.find_index { |x| not x.nil? and not x.eql?("nil") and not (not x.index("%").nil? && x.match(/%\{[^}]\}/).nil?) }
    if not not_nul_index.nil?
      event.set(field, substitution_parsed[not_nul_index])
    end
  end # @coalesce_parsed.each
end
condrewrite(event) click to toggle source
# File lib/logstash/filters/alter.rb, line 115
def condrewrite(event)
  @condrewrite_parsed.each do |config|
    field = config[:field]
    expected = config[:expected]
    replacement = config[:replacement]
    if event.get(field).is_a?(Array)
      new_array = event.get(field).map do |v|
        if v == event.sprintf(expected)
          v = event.sprintf(replacement)
        else
          v
        end
      end
      event.set(field, new_array)
    else
      if event.get(field) == event.sprintf(expected)
        # The usage of encode(UTF-8) is a workarround here until the new
        # version of logstash-core is released and include the fix for this
        # after that, this should be removed.
        event.set(field, event.sprintf(replacement).encode(Encoding::UTF_8))
      end
    end
  end # @condrewrite_parsed.each
end
condrewriteother(event) click to toggle source
# File lib/logstash/filters/alter.rb, line 141
def condrewriteother(event)
  @condrewriteother_parsed.each do |config|
    field = config[:field]
    expected = config[:expected]
    replacement_field = config[:replacement_field]
    replacement_value = config[:replacement_value]

    if event.get(field).is_a?(Array)
      event.get(field).each do |v|
        if v == event.sprintf(expected)
          event.set(replacement_field, event.sprintf(replacement_value))
        end
      end
    else
      if event.get(field) == event.sprintf(expected)
        event.set(replacement_field, event.sprintf(replacement_value))
      end
    end
  end # @condrewriteother_parsed.each
end