class LogStash::Filters::RecordSplit

This filter will replace the contents of the default message field with whatever you specify in the configuration.

It is only intended to be used as an .

Constants

PARSE_FAILURE_TAG

Public Instance Methods

filter(event) { |event_split| ... } click to toggle source
# File lib/logstash/filters/record_split.rb, line 36
def filter(event)
  original_value = event.get(@field)

  if original_value.is_a?(Array)
    splits = @target.nil? ? event.remove(@field) : original_value
  elsif original_value.is_a?(String)
    # Using -1 for 'limit' on String#split makes ruby not drop trailing empty
    # splits.
    splits = original_value.split(@terminator, -1)
  else
    logger.warn("Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}")
    event.tag(PARSE_FAILURE_TAG)
    return
  end

  # Skip filtering if splitting this event resulted in only one thing found.
  return if splits.length == 1 && original_value.is_a?(String)

  # set event_target to @field if not configured
  event_target = @target.nil? ? @field : @target
  splits.each do |value|
    next if value.nil? || (value.is_a?(String) && value.empty?)
    @logger.debug? && @logger.debug("Split event", :value => value, :field => @field)

    # OLD IMPLEMENTATION
    # event_split = event.clone
    # event_split.set(event_target, value)
    # filter_matched(event_split)
    begin
      event_split = LogStash::Event.new(value)
      filter_matched(event_split)
    rescue => e
      puts original_value
      puts e
    end
    # Push this new event onto the stack at the LogStash::FilterWorker
    yield event_split
  end

  # Cancel this event, we'll use the newly generated ones above.
  event.cancel
end
register() click to toggle source
# File lib/logstash/filters/record_split.rb, line 31
def register
  # Add instance variables
end