class LogStash::Filters::Logfmt

Add any asciidoc formatted documentation here

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/logfmt.rb, line 30
def filter(event)
  return if resolve(event).nil?
  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/logfmt.rb, line 26
def register
  @logger.info 'Logfmt filter registered'
end
resolve(event) click to toggle source
# File lib/logstash/filters/logfmt.rb, line 35
def resolve(event)
  data = event.get(@source)
  params = Logfmt.parse(data)

  # log line should at least have level
  return if !params['level'].is_a?(String) || params['level'].empty?

  if params['stacktrace']
    if params['stacktrace'].start_with?('[')
      params['stacktrace'] = params['stacktrace'][1..-2].split('][')
    else
      params['stacktrace'] = params['stacktrace'].split(',')
    end
  end
  event.set(@target, process_hash(params))
  event.set(@source, nil) if @remove_source
  return true
rescue => e
  log_exception(e, data)
  nil
end

Private Instance Methods

log_exception(e, data) click to toggle source
# File lib/logstash/filters/logfmt.rb, line 59
def log_exception(e, data)
  @logger.error({
    msg: 'Failed to parse logfmt string',
    error: {
      message: e.message,
      err: e.class.to_s,
      data: data,
      stacktrace: (e.backtrace && e.backtrace.join(','))
    }
  }.to_json)
end
process_hash(hash) click to toggle source
# File lib/logstash/filters/logfmt.rb, line 71
def process_hash(hash)
  hash.each_with_object({}) do |(key,value), all|
    key_parts = key.split('.')
    leaf = key_parts[0...-1].inject(all) { |h, k| h[k] ||= {} }
    leaf[key_parts.last] = value
  end.each_with_object({}) do |(key,value), all|
    next all[key] = value.to_json if @convert_to_json.include?(key)
    next all[key] = value.to_s if @convert_to_string.include?(key)
    all[key] = value
  end
end