class LogStash::Filters::Alter
The alter filter allows you to do general alterations to fields that are not included in the normal mutate filter.
NOTE: The functionality provided by this plugin is likely to be merged into the 'mutate' filter in future versions.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/alter.rb, line 104 def filter(event) condrewrite(event) if @condrewrite condrewriteother(event) if @condrewriteother coalesce(event) if @coalesce filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/alter.rb, line 61 def register @condrewrite_parsed = [] @condrewrite.nil? or @condrewrite.each_slice(3) do |field, expected, replacement| if [field, expected, replacement].any? {|n| n.nil?} @logger.error("Invalid condrewrte configuration. condrewrite has to define 3 elements per config entry", :field => field, :expected => expected, :replacement => replacement) raise "Bad configuration, aborting." end @condrewrite_parsed << { :field => field, :expected => expected, :replacement => replacement } end # condrewrite @condrewriteother_parsed = [] @condrewriteother.nil? or @condrewriteother.each_slice(4) do |field, expected, replacement_field, replacement_value| if [field, expected, replacement_field, replacement_value].any? {|n| n.nil?} @logger.error("Invalid condrewrteother configuration. condrewriteother has to define 4 elements per config entry", :field => field, :expected => expected, :replacement_field => replacement_field, :replacement_value => replacement_value) raise "Bad configuration, aborting." end @condrewriteother_parsed << { :field => field, :expected => expected, :replacement_field => replacement_field, :replacement_value => replacement_value } end # condrewriteother @coalesce_parsed = [] @coalesce.nil? or if not @coalesce.is_a?(Array) or @coalesce.length < 2 @logger.error("Invalid coalesce configuration. coalesce has to define one Array of at least 2 elements") raise "Bad configuration, aborting." else @coalesce_parsed << { :field => @coalesce.slice!(0), :subst_array => @coalesce } end end
Private Instance Methods
coalesce(event)
click to toggle source
# File lib/logstash/filters/alter.rb, line 163 def coalesce(event) @coalesce_parsed.each do |config| field = config[:field] subst_array = config[:subst_array] substitution_parsed = subst_array.map { |x| event.sprintf(x) } not_nul_index = substitution_parsed.find_index { |x| not x.nil? and not x.eql?("nil") and not (not x.index("%").nil? && x.match(/%\{[^}]\}/).nil?) } if not not_nul_index.nil? event.set(field, substitution_parsed[not_nul_index]) end end # @coalesce_parsed.each end
condrewrite(event)
click to toggle source
# File lib/logstash/filters/alter.rb, line 115 def condrewrite(event) @condrewrite_parsed.each do |config| field = config[:field] expected = config[:expected] replacement = config[:replacement] if event.get(field).is_a?(Array) new_array = event.get(field).map do |v| if v == event.sprintf(expected) v = event.sprintf(replacement) else v end end event.set(field, new_array) else if event.get(field) == event.sprintf(expected) # The usage of encode(UTF-8) is a workarround here until the new # version of logstash-core is released and include the fix for this # after that, this should be removed. event.set(field, event.sprintf(replacement).encode(Encoding::UTF_8)) end end end # @condrewrite_parsed.each end
condrewriteother(event)
click to toggle source
# File lib/logstash/filters/alter.rb, line 141 def condrewriteother(event) @condrewriteother_parsed.each do |config| field = config[:field] expected = config[:expected] replacement_field = config[:replacement_field] replacement_value = config[:replacement_value] if event.get(field).is_a?(Array) event.get(field).each do |v| if v == event.sprintf(expected) event.set(replacement_field, event.sprintf(replacement_value)) end end else if event.get(field) == event.sprintf(expected) event.set(replacement_field, event.sprintf(replacement_value)) end end end # @condrewriteother_parsed.each end