class LogStash::Codecs::CloudWatchLogs
Parse CloudWatch Logs
Public Instance Methods
decode(data, &block)
click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 20 def decode(data, &block) data = decompress(StringIO.new(data)) if @decompress parse(LogStash::Json.load(data), &block) end
register()
click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 18 def register; end
Private Instance Methods
decompress(data)
click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 26 def decompress(data) gz = Zlib::GzipReader.new(data) gz.read rescue Zlib::Error, Zlib::GzipFile::Error => e @logger.error("Error decompressing CloudWatch Logs data: #{e}") end
parse(json) { |event(merge)| ... }
click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 33 def parse(json, &block) events = json.delete("logEvents") json.freeze events.each do |event| epochmillis = event.delete("timestamp").to_i event[LogStash::Event::TIMESTAMP] = LogStash::Timestamp.at(epochmillis / 1000, (epochmillis % 1000) * 1000) yield LogStash::Event.new(json.merge(event)) end end