class LogStash::Filters::Yaml
This is a YAML parsing filter. It takes an existing field which contains YAML and expands it into an actual data structure within the Logstash event.
By default it will place the parsed YAML in the root (top level) of the Logstash event, but this filter can be configured to place the YAML into any arbitrary event field, using the `target` configuration.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/yaml.rb, line 55 def filter(event) return unless filter?(event) @logger.debug("Running yaml filter", :event => event) return unless event.include?(@source) source = event.get(@source) begin parsed = YAML::load(source) rescue => e event.tag("_yamlparsefailure") @logger.warn("Error parsing yaml", :source => @source, :raw => event.get(@source), :exception => e.message) return end if @target event.set(@target, parsed) else unless parsed.is_a?(Hash) event.tag("_yamlparsefailure") @logger.warn("Parsed YAML object/hash requires a target configuration option", :source => @source, :raw => source) return end # The following logic was copied from Json filter # a) since the parsed hash will be set in the event root, first extract any @timestamp field to properly initialized it parsed_timestamp = parsed.delete(LogStash::Event::TIMESTAMP) begin timestamp = parsed_timestamp ? LogStash::Timestamp.coerce(parsed_timestamp) : nil rescue LogStash::TimestampParserError => e timestamp = nil end # b) then set all parsed fields in the event parsed.each{|k, v| event.set(k, v)} # c) finally re-inject proper @timestamp if parsed_timestamp if timestamp event.timestamp = timestamp else event.timestamp = LogStash::Timestamp.new @logger.warn("Unrecognized #{LogStash::Event::TIMESTAMP} value, setting current time to #{LogStash::Event::TIMESTAMP}, original in #{LogStash::Event::TIMESTAMP_FAILURE_FIELD} field", :value => parsed_timestamp.inspect) event.tag(LogStash::Event::TIMESTAMP_FAILURE_TAG) event.set(LogStash::Event::TIMESTAMP_FAILURE_FIELD, parsed_timestamp.to_s) end end end filter_matched(event) @logger.debug? && @logger.debug("Event after yaml filter", :event => event.inspect) end
register()
click to toggle source
# File lib/logstash/filters/yaml.rb, line 50 def register require 'yaml' end