class Observed::Plugins::Logstash
Public Instance Methods
build_body()
click to toggle source
# File lib/observed/logstash.rb, line 32 def build_body { :query => query, :filter => build_timestamp_filter } end
build_client()
click to toggle source
# File lib/observed/logstash.rb, line 17 def build_client Elasticsearch::Client.new host: host end
build_data(hits)
click to toggle source
# File lib/observed/logstash.rb, line 39 def build_data(hits) data = { hits: hits, min_hits: min_hits, max_hits: max_hits } if hits < min_hits data[:status] = :error data[:message] = "Not enough hits. Only #{hits} in the last #{timespan_in_seconds} seconds, required at least #{min_hits}" elsif hits > max_hits data[:status] = :error data[:message] = "Too many hits. Got #{hits} in the last #{timespan_in_seconds} seconds, required at most #{max_hits}" else data[:status] = :success data[:message] = "#{hits} hits in the last #{timespan_in_seconds} seconds" end data end
build_timestamp_filter()
click to toggle source
# File lib/observed/logstash.rb, line 21 def build_timestamp_filter { :range => { :@timestamp => { :from => (system.now.to_f * 1000).to_i - (1000 * timespan_in_seconds), :to => (system.now.to_f * 1000).to_i } } } end
logger()
click to toggle source
# File lib/observed/logstash.rb, line 73 def logger @logger ||= Logger.new(STDOUT) end
observe()
click to toggle source
# File lib/observed/logstash.rb, line 55 def observe logger.debug "Host: #{host}, index name format: #{index_name_format}, query: [#{query}], timespan: #{timespan_in_seconds}s, max hits: #{max_hits}, min hits: #{min_hits}" index = system.now.strftime(index_name_format) body = build_body logger.debug "Index: #{index}, Body: #{body}" client = build_client response = client.search :index => index, :body => body hits = response['hits']['total'].to_i logger.debug("Hits: #{hits}") data = build_data(hits) system.report("#{self.tag}.#{data[:status]}", data) end