class LogStash::Filters::Split
The split filter clones an event by splitting one of its fields and placing each value resulting from the split into a clone of the original event. The field being split can either be a string or an array.
An example use case of this filter is for taking output from the <<plugins-inputs-exec,exec input plugin>> which emits one event for the whole output of a command and splitting that output by newline - making each line an event.
Split
filter can also be used to split array fields in events into individual events. A very common pattern in JSON & XML is to make use of lists to group data together.
For example, a json structure like this:
- source,js
{ field1: …,
results: [ { result ... }, { result ... }, { result ... }, ...
] }
The split filter can be used on the above data to create separate events for each value of `results` field
- source,js
filter {
split { field => "results" }
}
The end result of each split is a complete copy of the event with only the current split section of the given field changed.
Constants
- PARSE_FAILURE_TAG
Public Instance Methods
# File lib/logstash/filters/split.rb, line 67 def filter(event) original_value = event.get(@field) if original_value.is_a?(Array) splits = target.nil? ? event.remove(@field) : original_value elsif original_value.is_a?(String) # Using -1 for 'limit' on String#split makes ruby not drop trailing empty # splits. splits = original_value.split(@terminator, -1) else logger.warn("Only String and Array types are splittable. field:#{@field} is of type = #{original_value.class}") event.tag(PARSE_FAILURE_TAG) return end # Skip filtering if splitting this event resulted in only one thing found. return if splits.length == 1 && original_value.is_a?(String) #or splits[1].empty? splits.each do |value| next if value.nil? || value.empty? event_split = event.clone @logger.debug("Split event", :value => value, :field => @field) if @target.nil? event_split.set(@field, value) else event_split.set(@target, value) end filter_matched(event_split) # Push this new event onto the stack at the LogStash::FilterWorker yield event_split end # Cancel this event, we'll use the newly generated ones above. event.cancel end
# File lib/logstash/filters/split.rb, line 62 def register # Nothing to do end