class LogStash::Filters::RecordSplit
This filter will replace the contents of the default message field with whatever you specify in the configuration.
It is only intended to be used as an .
Constants
- PARSE_FAILURE_TAG
Public Instance Methods
filter(event) { |event_split| ... }
click to toggle source
# File lib/logstash/filters/record_split.rb, line 36 def filter(event) original_value = event.get(@field) if original_value.is_a?(Array) splits = @target.nil? ? event.remove(@field) : original_value elsif original_value.is_a?(String) # Using -1 for 'limit' on String#split makes ruby not drop trailing empty # splits. splits = original_value.split(@terminator, -1) else logger.warn("Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}") event.tag(PARSE_FAILURE_TAG) return end # Skip filtering if splitting this event resulted in only one thing found. return if splits.length == 1 && original_value.is_a?(String) # set event_target to @field if not configured event_target = @target.nil? ? @field : @target splits.each do |value| next if value.nil? || (value.is_a?(String) && value.empty?) @logger.debug? && @logger.debug("Split event", :value => value, :field => @field) # OLD IMPLEMENTATION # event_split = event.clone # event_split.set(event_target, value) # filter_matched(event_split) begin event_split = LogStash::Event.new(value) filter_matched(event_split) rescue => e puts original_value puts e end # Push this new event onto the stack at the LogStash::FilterWorker yield event_split end # Cancel this event, we'll use the newly generated ones above. event.cancel end
register()
click to toggle source
# File lib/logstash/filters/record_split.rb, line 31 def register # Add instance variables end