class LogStash::Inputs::AzureWADTable
Constants
- TICKS_SINCE_EPOCH
Public Class Methods
new(*args)
click to toggle source
Calls superclass method
# File lib/logstash/inputs/azurewadtable.rb, line 23 def initialize(*args) super(*args) end
Public Instance Methods
partitionkey_from_datetime(time_string)
click to toggle source
Windows Azure Diagnostic's algorithm for determining the partition key based on time is as follows:
-
Take time in UTC without seconds.
-
Convert it into .net ticks
-
add a '0' prefix.
# File lib/logstash/inputs/azurewadtable.rb, line 113 def partitionkey_from_datetime(time_string) collection_time = Time.parse(time_string) if collection_time @logger.debug("collection time parsed successfully #{collection_time}") else raise(ArgumentError, "Could not parse the time_string") end # if else block collection_time -= collection_time.sec ticks = to_ticks(collection_time) "0#{ticks}" end
process(output_queue)
click to toggle source
# File lib/logstash/inputs/azurewadtable.rb, line 53 def process(output_queue) @logger.debug(@last_timestamp) # query data using start_from_time query_filter = "(PartitionKey gt '#{partitionkey_from_datetime(@last_timestamp)}')" for i in 0..99 query_filter << " or (PartitionKey gt '#{i.to_s.rjust(19, '0')}___#{partitionkey_from_datetime(@last_timestamp)}' and PartitionKey lt '#{i.to_s.rjust(19, '0')}___9999999999999999999')" end # for block query_filter = query_filter.gsub('"','') @logger.debug("Query filter: " + query_filter) query = { :top => @entity_count_to_process, :filter => query_filter, :continuation_token => @continuation_token } result = @azure_table_service.query_entities(@table_name, query) @continuation_token = result.continuation_token if result and result.length > 0 result.each do |entity| event = LogStash::Event.new(entity.properties) event["type"] = @table_name # Help pretty print etw files if (@etw_pretty_print && !event["EventMessage"].nil? && !event["Message"].nil?) logger.debug("event: " + event.to_s) eventMessage = event["EventMessage"].to_s message = event["Message"].to_s logger.debug("EventMessage: " + eventMessage) logger.debug("Message: " + message) if (eventMessage.include? "%") logger.debug("starting pretty print") toReplace = eventMessage.scan(/%\d+/) payload = message.scan(/(?<!\\S)([a-zA-Z]+)=(\"[^\"]*\")(?!\\S)/) # Split up the format string to seperate all of the numbers toReplace.each do |key| logger.debug("Replacing key: " + key.to_s) index = key.scan(/\d+/).join.to_i newValue = payload[index - 1][1] logger.debug("New Value: " + newValue) eventMessage[key] = newValue end event["EventMessage"] = eventMessage logger.debug("pretty print end. result: " + event["EventMessage"].to_s) end end output_queue << event end # each block @idle_delay = 0 @last_timestamp = result.last.properties["TIMESTAMP"].iso8601 unless @continuation_token else @logger.debug("No new results found.") @idle_delay = @idle_delay_seconds end # if block rescue => e @logger.error("Oh My, An error occurred.", :exception => e) raise end
register()
click to toggle source
# File lib/logstash/inputs/azurewadtable.rb, line 28 def register Azure.configure do |config| config.storage_account_name = @account_name config.storage_access_key = @access_key end @azure_table_service = Azure::Table::TableService.new @last_timestamp = @collection_start_time_utc @idle_delay = @idle_delay_seconds @continuation_token = nil end
run(output_queue)
click to toggle source
# File lib/logstash/inputs/azurewadtable.rb, line 40 def run(output_queue) loop do @logger.debug("Starting process method @" + Time.now.to_s); process(output_queue) @logger.debug("Starting delay of: " + @idle_delay_seconds.to_s + " seconds @" + Time.now.to_s); sleep @idle_delay end # loop end
teardown()
click to toggle source
# File lib/logstash/inputs/azurewadtable.rb, line 50 def teardown end
to_ticks(time_to_convert)
click to toggle source
Convert time to ticks
# File lib/logstash/inputs/azurewadtable.rb, line 127 def to_ticks(time_to_convert) @logger.debug("Converting time to ticks") time_to_convert.to_i * 10000000 - TICKS_SINCE_EPOCH end