class LogStash::Filters::Urldecode

The urldecode filter is for decoding fields that are urlencoded.

Constants

UnescapePack
UnescapePercent
UnescapeRe

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/urldecode.rb, line 38
def filter(event)
  begin
    # If all_fields is true then try to decode them all
    if @all_fields
      event.to_hash.each do |name, value|
        event.set(name, urldecode(value))
      end
    # else decode the specified field
    else
      event.set(field, urldecode(event.get(@field)))
    end
  rescue => e
    @tag_on_failure.each{|tag| event.tag(tag)}
  end

  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/urldecode.rb, line 32
def register
  @converter = LogStash::Util::Charset.new(@charset)
  @converter.logger = logger
end

Private Instance Methods

unescape(value) click to toggle source
# File lib/logstash/filters/urldecode.rb, line 58
def unescape(value)
  # There is a bug in the Ruby stdlib URI.unescape
  # this: URI.unescape("europ%C3%A9enneeuropéenne") throws the following error
  # Encoding::CompatibilityError: incompatible encodings: ASCII-8BIT and UTF-8
  # because Array#pack returns ASCII-8BIT encoded strings
  # this a hybrid of URI.unescape and CGI.unescape
  value.gsub(UnescapeRe){|s|[s.delete(UnescapePercent)].pack(UnescapePack).force_encoding(value.encoding) }
end
urldecode(value) click to toggle source

Attempt to handle string, array, and hash values for fields. For all other datatypes, just return, URI.unescape doesn't support them.

# File lib/logstash/filters/urldecode.rb, line 69
def urldecode(value)
  case value
  when String
    escaped = unescape(value)
    return @converter.convert(escaped)
  when Array
    ret_values = []
    value.each { |v| ret_values << urldecode(v) }
    return ret_values
  when Hash
    ret_values = {}
    value.each { |k,v| ret_values[k] = urldecode(v) }
    return ret_values
  else
    return value
  end
end