class LogStash::Filters::ThrottleProp
The throttle-prop-filter is to throttle events per a dynamic property. The filter is configured with a key, a value and a limit. The key is used to group the values. If the values with a different content are be inserted more than limit, it will be filtered
For example, if you wanted to throttle events per a property “type”, and you didn't want to have more than two differents types, you would use the configuration:
- source, ruby
-
key => “%{property_key}” value => “%{type}” limit => 2
Which would result in:
¶ ↑
event 1 { property_key => 'some_key', type => 'a' } - not throttled event 2 { property_key => 'some_key', type => 'a' } - not throttled event 3 { property_key => 'some_key', type => 'b' } - not throttled event 4 { property_key => 'some_key', type => 'b' } - not throttled event 5 { property_key => 'some_key', type => 'c' } - throttled (successful filter) event 6 { property_key => 'some_key', type => 'c' } - throttled (successful filter) event 7 { property_key => 'some_key', type => 'a' } - not throttled event 8 { property_key => 'some_key', type => 'b' } - not throttled event 9 { property_key => 'some_key', type => 'c' } - throttled (successful filter) event 10 { property_key => 'some_key', type => 'd' } - throttled (successful filter) event 11 { property_key => 'other_key', type => 'd' } - not throttled
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/throttle_prop.rb, line 51 def filter(event) event_key = event.sprintf(@key) event_value = event.sprintf(@value) event_limit = event.sprintf(@limit).to_i if @keys.has_key? event_key unless @keys[event_key].include? event_value if @keys[event_key].length + 1 > event_limit filter_matched(event) else @keys[event_key].push(event_value) end end else @keys[event_key] = [event_value] end end
register()
click to toggle source
# File lib/logstash/filters/throttle_prop.rb, line 46 def register @keys = Hash.new end