class Fluent::Plugin::ECSMetadataFilter
Public Instance Methods
configure(conf)
click to toggle source
Calls superclass method
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 19 def configure(conf) super require 'fluent_ecs' validate_params FluentECS.configure do |c| c.cache_size = @cache_size c.cache_ttl = @cache_ttl < 0 ? :none : @cache_ttl c.fields = @fields end @tag_regexp_compiled = Regexp.compile(@tag_regexp) end
filter_stream(tag, es)
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 35 def filter_stream(tag, es) new_es = Fluent::MultiEventStream.new metadata = metadata_for_tag(tag) es.each do |time, record| if metadata record = merge_log_json(record) if merge_json_logs? record['ecs'] = metadata.to_h end new_es.add(time, record) end new_es end
looks_like_json?(str)
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 64 def looks_like_json?(str) str.is_a?(String) && str[0] == '{' && str[-1] == '}' end
merge_json_logs?()
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 68 def merge_json_logs? @merge_json_log end
merge_log_json(record)
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 72 def merge_log_json(record) log = record['log'] if looks_like_json?(log) begin record = JSON.parse(log).merge!(record) record.delete('log') rescue JSON::ParserError => e self.log.error(e) end end record end
metadata_for_tag(tag)
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 56 def metadata_for_tag(tag) match = tag.match(@tag_regexp_compiled) FluentECS::Container.find(match['docker_id']) unless match.nil? rescue FluentECS::IntrospectError => e log.error(e) nil end
validate_params()
click to toggle source
# File lib/fluent/plugin/filter_ecs_metadata.rb, line 51 def validate_params bad_field = @fields.find { |f| !FluentECS::Container.method_defined?(f) } raise Fluent::ConfigError, "Invalid field: '#{bad_field}'" if bad_field end