class LogStash::Codecs::CloudWatchLogs

Parse CloudWatch Logs

Public Instance Methods

decode(data, &block) click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 20
def decode(data, &block)
  data = decompress(StringIO.new(data)) if @decompress
  parse(LogStash::Json.load(data), &block)
end
register() click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 18
def register; end

Private Instance Methods

decompress(data) click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 26
def decompress(data)
  gz = Zlib::GzipReader.new(data)
  gz.read
rescue Zlib::Error, Zlib::GzipFile::Error => e
  @logger.error("Error decompressing CloudWatch Logs data: #{e}")
end
parse(json) { |event(merge)| ... } click to toggle source
# File lib/logstash/codecs/cloudwatch_logs.rb, line 33
def parse(json, &block)
  events = json.delete("logEvents")
  json.freeze

  events.each do |event|
    epochmillis = event.delete("timestamp").to_i
    event[LogStash::Event::TIMESTAMP] = LogStash::Timestamp.at(epochmillis / 1000, (epochmillis % 1000) * 1000)
    yield LogStash::Event.new(json.merge(event))
  end
end