class LogStash::Filters::Esquerystring
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/esquerystring.rb, line 19 def filter(event) values = [] @source.each do |field| next unless event.include?(field) value = event.get(field) next if value.nil? value = [value] unless value.is_a?(Array) next if value.length == 0 values += value end values.compact! return if values.length == 0 values = values.uniq.map { |x| '"' + x + '"' } values_str = "(" + values.join(" OR ") + ")" if values_str.length > @maxlength msg = "Produced too long query string (>#{@maxlength}): #{values_str}" if @length_autofix while values_str.length > @maxlength values.pop values_str = "(" + values.join(" OR ") + ")" end @logger.warn(msg + "; Autofixed to: #{values_str}") event.set(@target, values_str) else @logger.error(msg) end else event.set(@target, values_str) end end
register()
click to toggle source
# File lib/logstash/filters/esquerystring.rb, line 14 def register # Nothing to do end