class LogStash::Filters::Urldecode
The urldecode filter is for decoding fields that are urlencoded.
Constants
- UnescapePack
- UnescapePercent
- UnescapeRe
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/urldecode.rb, line 38 def filter(event) begin # If all_fields is true then try to decode them all if @all_fields event.to_hash.each do |name, value| event.set(name, urldecode(value)) end # else decode the specified field else event.set(field, urldecode(event.get(@field))) end rescue => e @tag_on_failure.each{|tag| event.tag(tag)} end filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/urldecode.rb, line 32 def register @converter = LogStash::Util::Charset.new(@charset) @converter.logger = logger end
Private Instance Methods
unescape(value)
click to toggle source
# File lib/logstash/filters/urldecode.rb, line 58 def unescape(value) # There is a bug in the Ruby stdlib URI.unescape # this: URI.unescape("europ%C3%A9enneeuropéenne") throws the following error # Encoding::CompatibilityError: incompatible encodings: ASCII-8BIT and UTF-8 # because Array#pack returns ASCII-8BIT encoded strings # this a hybrid of URI.unescape and CGI.unescape value.gsub(UnescapeRe){|s|[s.delete(UnescapePercent)].pack(UnescapePack).force_encoding(value.encoding) } end
urldecode(value)
click to toggle source
Attempt to handle string, array, and hash values for fields. For all other datatypes, just return, URI.unescape doesn't support them.
# File lib/logstash/filters/urldecode.rb, line 69 def urldecode(value) case value when String escaped = unescape(value) return @converter.convert(escaped) when Array ret_values = [] value.each { |v| ret_values << urldecode(v) } return ret_values when Hash ret_values = {} value.each { |k,v| ret_values[k] = urldecode(v) } return ret_values else return value end end