class LogStash::Filters::Logfmt
Add any asciidoc formatted documentation here
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/logfmt.rb, line 30 def filter(event) return if resolve(event).nil? filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/logfmt.rb, line 26 def register @logger.info 'Logfmt filter registered' end
resolve(event)
click to toggle source
# File lib/logstash/filters/logfmt.rb, line 35 def resolve(event) data = event.get(@source) params = Logfmt.parse(data) # log line should at least have level return if !params['level'].is_a?(String) || params['level'].empty? if params['stacktrace'] if params['stacktrace'].start_with?('[') params['stacktrace'] = params['stacktrace'][1..-2].split('][') else params['stacktrace'] = params['stacktrace'].split(',') end end event.set(@target, process_hash(params)) event.set(@source, nil) if @remove_source return true rescue => e log_exception(e, data) nil end
Private Instance Methods
log_exception(e, data)
click to toggle source
# File lib/logstash/filters/logfmt.rb, line 59 def log_exception(e, data) @logger.error({ msg: 'Failed to parse logfmt string', error: { message: e.message, err: e.class.to_s, data: data, stacktrace: (e.backtrace && e.backtrace.join(',')) } }.to_json) end
process_hash(hash)
click to toggle source
# File lib/logstash/filters/logfmt.rb, line 71 def process_hash(hash) hash.each_with_object({}) do |(key,value), all| key_parts = key.split('.') leaf = key_parts[0...-1].inject(all) { |h, k| h[k] ||= {} } leaf[key_parts.last] = value end.each_with_object({}) do |(key,value), all| next all[key] = value.to_json if @convert_to_json.include?(key) next all[key] = value.to_s if @convert_to_string.include?(key) all[key] = value end end