class LogStash::Codecs::ESBulk
This codec will decode the www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-bulk.html[Elasticsearch bulk format] into individual events, plus metadata into the `@metadata` field.
Encoding is not supported at this time as the Elasticsearch output submits Logstash events in bulk format.
Public Class Methods
new(params={})
click to toggle source
Calls superclass method
# File lib/logstash/codecs/es_bulk.rb, line 33 def initialize(params={}) super(params) @lines = LogStash::Codecs::Line.new @lines.charset = "UTF-8" @state = :initial @metadata = Hash.new @metadata_field = ecs_select[disabled: '[@metadata]', v1: '[@metadata][codec][es_bulk]'] end
Public Instance Methods
decode(data) { |event| ... }
click to toggle source
# File lib/logstash/codecs/es_bulk.rb, line 46 def decode(data) @lines.decode(data) do |bulk| begin line = LogStash::Json.load(bulk.get("message")) case @state when :metadata event = targeted_event_factory.new_event(line) event.set(@metadata_field, @metadata) yield event @state = :initial when :initial @metadata = line[line.keys[0]] @metadata["action"] = line.keys[0].to_s @state = :metadata if line.keys[0] == 'delete' event = targeted_event_factory.new_event event.set(@metadata_field, @metadata) yield event @state = :initial end end rescue LogStash::Json::ParserError => e @logger.error("JSON parse failure. ES Bulk messages must in be UTF-8 JSON", :error => e, :data => data) end end end
register()
click to toggle source
# File lib/logstash/codecs/es_bulk.rb, line 42 def register end