class LogStash::Filters::Emoji
This plugin maps the severity names or numeric codes as defined in tools.ietf.org/html/rfc3164#section-4.1.1[RFC 3164] and tools.ietf.org/html/rfc5424#section-6.2.1[RFC 5424] to the emoji as defined in the configuration.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/emoji.rb, line 85 def filter(event) return unless event.include?(@field) # Skip if event does not have specified field. return if event.include?(@target) and not @override # Skip if @target field already exists and @override is false. begin #If source field is array use first value and make sure source value is string source = event.get(@field).is_a?(Array) ? event.get(@field).first.to_s : event.get(@field).to_s matched = false key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))} if key event.set(@target, @dictionary[key] ) metric.increment(:matches) matched = true end if not matched and @fallback event.set(@target, event.sprintf(@fallback)) metric.increment(:matches) matched = true end filter_matched(event) if matched or @field == @target rescue Exception => e metric.increment(:failures) @logger.error("Something went wrong when attempting to match from dictionary", :exception => e, :field => @field, :event => event) end end
register()
click to toggle source
# File lib/logstash/filters/emoji.rb, line 65 def register @dictionary = { "^0$|Emergency|EMERGENCY|emerg|EMERG" => @sev_emergency, "^1$|Alert|ALERT|alert" => @sev_alert, "^2$|Critical|CRITICAL|crit|CRIT" => @sev_critical, "^3$|Error|ERROR|err|ERR" => @sev_error, "^4$|Warning|WARNING|warn|WARN" => @sev_warning, "^5$|Notice|NOTICE|notice" => @sev_notice, "^6$|Informational|INFORMATIONAL|info|INFO" => @sev_info, "^7$|Debug|DEBUG|debug" => @sev_debug } @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary) if @exact @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Exact") else @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Fuzzy") end end