class LogStash::Filters::Yaml

This is a YAML parsing filter. It takes an existing field which contains YAML and expands it into an actual data structure within the Logstash event.

By default it will place the parsed YAML in the root (top level) of the Logstash event, but this filter can be configured to place the YAML into any arbitrary event field, using the `target` configuration.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/yaml.rb, line 55
def filter(event)
  return unless filter?(event)

  @logger.debug("Running yaml filter", :event => event)

  return unless event.include?(@source)

  source = event.get(@source)

  begin
    parsed = YAML::load(source)
  rescue => e
    event.tag("_yamlparsefailure")
    @logger.warn("Error parsing yaml", :source => @source,
                 :raw => event.get(@source), :exception => e.message)
    return
  end

  if @target
    event.set(@target, parsed)
  else
    unless parsed.is_a?(Hash)
      event.tag("_yamlparsefailure")
      @logger.warn("Parsed YAML object/hash requires a target configuration option", :source => @source, :raw => source)
      return
    end

    # The following logic was copied from Json filter
    # a) since the parsed hash will be set in the event root, first extract any @timestamp field to properly initialized it
    parsed_timestamp = parsed.delete(LogStash::Event::TIMESTAMP)
    begin
      timestamp = parsed_timestamp ? LogStash::Timestamp.coerce(parsed_timestamp) : nil
    rescue LogStash::TimestampParserError => e
      timestamp = nil
    end

    # b) then set all parsed fields in the event
    parsed.each{|k, v| event.set(k, v)}

    # c) finally re-inject proper @timestamp
    if parsed_timestamp
      if timestamp
        event.timestamp = timestamp
      else
        event.timestamp = LogStash::Timestamp.new
        @logger.warn("Unrecognized #{LogStash::Event::TIMESTAMP} value, setting current time to #{LogStash::Event::TIMESTAMP}, original in #{LogStash::Event::TIMESTAMP_FAILURE_FIELD} field", :value => parsed_timestamp.inspect)
        event.tag(LogStash::Event::TIMESTAMP_FAILURE_TAG)
        event.set(LogStash::Event::TIMESTAMP_FAILURE_FIELD, parsed_timestamp.to_s)
      end
    end
  end

  filter_matched(event)
  @logger.debug? && @logger.debug("Event after yaml filter", :event => event.inspect)
end
register() click to toggle source
# File lib/logstash/filters/yaml.rb, line 50
def register
  require 'yaml'
end