class LogStash::Filters::DateParts

This filter will add date parts to your record based on the timestamp field.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/dateparts.rb, line 62
def filter(event)
  invalid = true
  event_time = get_time_from_field(event.get(@time_field))
  if event_time == nil
    plugin_error("Invalid time field #{@time_field}; Time field must be an instance of Time or provide a time method that returns one", event)
    return
  end
  if @fields.respond_to?('each') and @fields.respond_to?('join')
    invalid = false
    logger.debug? and logger.debug("DateParts plugin filtering #{@time_field} time_field and adding fields: " + @fields.join(', '))
    @fields.each do |field|
      begin
        event.set(field, event_time.send(field))
      rescue
        plugin_error("No such method: #{field}\n", event)
      end
    end
  end
  if @duration != nil
    start_field = @duration['start_field']
    if(start_field == nil)
      start_field = '@timestamp'
    end
    start_time = get_time_from_field(event.get(start_field))

    end_field = @duration['end_field']
    if(end_field == nil)
      end_field = '@timestamp'
    end
    end_time = get_time_from_field(event.get(end_field))

    if start_time == nil or end_time == nil
      plugin_error("Invalid start [#{@duration['start_field']}] or end [#{@duration['end_field']}].  Time fields must be an instance of Time or provide a time method that returns one", event)
      return
    end
    if(start_field.eql?(end_field))
      logger.warn("Start and End fields are the same for dateparts filter [#{start_field}]")
    end

    result_field = @duration['result_field']
    if result_field == nil
      result_field = 'duration_result'
    end

    duration = end_time - start_time
    event.set(result_field, duration)
    invalid = false
  end
  if invalid
    plugin_error('DateParts plugin error', event)
    return
  end

  filter_matched(event)
end
get_time_from_field(f) click to toggle source
# File lib/logstash/filters/dateparts.rb, line 49
def get_time_from_field(f)
  if f.class == Time
    f
  elsif f.respond_to?('time')
    f.time
  elsif f.respond_to?('to_time')
    f.to_time
  else
    nil
  end
end
plugin_error(message, event) click to toggle source
# File lib/logstash/filters/dateparts.rb, line 44
def plugin_error(message, event)
  logger.error("DatePart filter error: #{message}")
  LogStash::Util::Decorators.add_tags(@error_tags, event, "filters/#{self.class.name}")
end
register() click to toggle source
# File lib/logstash/filters/dateparts.rb, line 40
def register
  logger.debug? and logger.debug('DateParts filter registered')
end