class LogStash::Filters::Emoji

This plugin maps the severity names or numeric codes as defined in tools.ietf.org/html/rfc3164#section-4.1.1[RFC 3164] and tools.ietf.org/html/rfc5424#section-6.2.1[RFC 5424] to the emoji as defined in the configuration.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/emoji.rb, line 85
def filter(event)
  return unless event.include?(@field) # Skip if event does not have specified field.
  return if event.include?(@target) and not @override # Skip if @target field already exists and @override is false.

  begin
    #If source field is array use first value and make sure source value is string
    source = event.get(@field).is_a?(Array) ? event.get(@field).first.to_s : event.get(@field).to_s
    matched = false
    key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))}
    if key
      event.set(@target, @dictionary[key] )
      metric.increment(:matches)
      matched = true
    end

    if not matched and @fallback
      event.set(@target, event.sprintf(@fallback))
      metric.increment(:matches)
      matched = true
    end
    filter_matched(event) if matched or @field == @target
  rescue Exception => e
    metric.increment(:failures)
    @logger.error("Something went wrong when attempting to match from dictionary", :exception => e, :field => @field, :event => event)
  end
end
register() click to toggle source
# File lib/logstash/filters/emoji.rb, line 65
def register
  @dictionary = {
     "^0$|Emergency|EMERGENCY|emerg|EMERG" => @sev_emergency,
     "^1$|Alert|ALERT|alert" => @sev_alert,
     "^2$|Critical|CRITICAL|crit|CRIT" => @sev_critical,
     "^3$|Error|ERROR|err|ERR" => @sev_error,
     "^4$|Warning|WARNING|warn|WARN" => @sev_warning,
     "^5$|Notice|NOTICE|notice" => @sev_notice,
     "^6$|Informational|INFORMATIONAL|info|INFO" => @sev_info,
     "^7$|Debug|DEBUG|debug" => @sev_debug
  }
  @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
  if @exact
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Exact")
  else
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Fuzzy")
  end
end