class LogStash::Filters::DateParts
This filter will add date parts to your record based on the timestamp field.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/dateparts.rb, line 62 def filter(event) invalid = true event_time = get_time_from_field(event.get(@time_field)) if event_time == nil plugin_error("Invalid time field #{@time_field}; Time field must be an instance of Time or provide a time method that returns one", event) return end if @fields.respond_to?('each') and @fields.respond_to?('join') invalid = false logger.debug? and logger.debug("DateParts plugin filtering #{@time_field} time_field and adding fields: " + @fields.join(', ')) @fields.each do |field| begin event.set(field, event_time.send(field)) rescue plugin_error("No such method: #{field}\n", event) end end end if @duration != nil start_field = @duration['start_field'] if(start_field == nil) start_field = '@timestamp' end start_time = get_time_from_field(event.get(start_field)) end_field = @duration['end_field'] if(end_field == nil) end_field = '@timestamp' end end_time = get_time_from_field(event.get(end_field)) if start_time == nil or end_time == nil plugin_error("Invalid start [#{@duration['start_field']}] or end [#{@duration['end_field']}]. Time fields must be an instance of Time or provide a time method that returns one", event) return end if(start_field.eql?(end_field)) logger.warn("Start and End fields are the same for dateparts filter [#{start_field}]") end result_field = @duration['result_field'] if result_field == nil result_field = 'duration_result' end duration = end_time - start_time event.set(result_field, duration) invalid = false end if invalid plugin_error('DateParts plugin error', event) return end filter_matched(event) end
get_time_from_field(f)
click to toggle source
# File lib/logstash/filters/dateparts.rb, line 49 def get_time_from_field(f) if f.class == Time f elsif f.respond_to?('time') f.time elsif f.respond_to?('to_time') f.to_time else nil end end
plugin_error(message, event)
click to toggle source
# File lib/logstash/filters/dateparts.rb, line 44 def plugin_error(message, event) logger.error("DatePart filter error: #{message}") LogStash::Util::Decorators.add_tags(@error_tags, event, "filters/#{self.class.name}") end
register()
click to toggle source
# File lib/logstash/filters/dateparts.rb, line 40 def register logger.debug? and logger.debug('DateParts filter registered') end