class LogStash::Filters::Varnishlog

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/varnishlog.rb, line 40
def filter(event)
  items = event.get("[message]").split("\n")
  if request=/\*+\s+<<\s+(?<type>\w+)\s+>>\s+(?<xid>\d+)/.match(items[0])
    event.set("type", request['type'].downcase)
    event.set("xid", request['xid'])
  end

  ##Begin
  if first=/-+\s+Begin\s+(?<id>\w+\s\d+\s\w+)/.match(items[1])
    event.set("begin", first['id'])
  end

  ##Remove Blacklisted items from items hash
  items = items.grepv(blacklist_sections.join("|")) if blacklist_sections.any?
  ##

  ##timestamps
  timestamps = items.grep(/Timestamp/)
  timestamps.each do |timestamp|
    if match = /-{1,2}\s+Timestamp\s+(?<step>\w{3,10}): (?<time_a>\d{10}\.\d{6}) (?<time_b>(0|\d+)\.\d{6}) (?<time_c>(0|\d+)\.\d{6})/.match(timestamp)
      event.set(normalize_fields("timestamp_" + match['step'] ), match['time_a'])
      event.set(normalize_fields("timestamp_" + match['step'] + "_raw"), match['time_a'] + " " + match['time_b'] + " " + match['time_c'])
    end
  end

  ##Acct
  account = items.grep(/(Be|Req)Acct/)
  account.each do |acct|
    if acct_match = /-\s+(Be|Req)Acct\s+(?<size_a>\d+)\s+(?<size_b>\d+)\s+(?<size_c>\d+)\s+(?<size_d>\d+)\s+(?<size_e>\d+)\s+(?<size_f>\d+)/.match(acct)
      event.set("bytes", acct_match['size_e'])
    end
  end
  ## VCL Log
  vcl_log = items.grep(/VCL_Log/)
  log_lines = []
  vcl_log.each_with_index do |log, index|
    if match = /-\s+VCL_Log\s+(?<log_line>.+)/.match(log)
      log_lines.push(match['log_line'])
    end
    if index == log_lines.size - 1
      event.set(normalize_fields("VCL_Log"), log_lines)
    end
  end

  # Requests
  ## Request headers.
  request_headers = items.grep(/(Bereq|Req|Beresp|Resp)Header/)
  request_headers.each do |header|
    if match = /-+\s+(Bereq|Req|Beresp|Resp)Header\s+(?<header_name>[\w-]+): (?<header_value>.*)/.match(header)
      event.set(normalize_fields(match['header_name']), match['header_value'])
    end
  end
  ## Match ReqMethod.
  if method_match = /-+\s+(Bereq|Req|Beresp|Resp)Method\s+(?<method>.+)/.match(items.grep(/(Bereq|Req|Beresp|Resp)Method/)[0])
    event.set("http_method", method_match['method'])
  end
  ## Match ReqURL.
  if url_match = /-+\s+(Bereq|Req|Beresp|Resp)URL\s+(?<url>\/.+)/.match(items.grep(/(Bereq|Req|Beresp|Resp)URL/)[0])
    event.set("url", url_match['url'])
  end
  ## Match ReqProtocol.
  if protocol_match = /-+\s+(Bereq|Req|Beresp|Resp)Protocol\s+(?<protocol>.+)/.match(items.grep(/(Bereq|Req|Beresp|Resp)Protocol/)[0])
    event.set("protocol", protocol_match['protocol'])
  end
  ## FetchError.
  if error_match = /-+\s+FetchError\s+(?<error>.+)/.match(items.grep(/FetchError/)[0])
    event.set("FetchError", error_match['error'])
  end
  ## Match RespStatus
  status_match = items.grep(/(Bereq|Req|Beresp|Resp)Status/)
  states = []
  status_match.each_with_index do |status, index|
    if match = /-+\s+(Bereq|Req|Beresp|Resp)Status\s+(?<status>\d{3})/.match(status)
      states.push(match['status'].to_i)
    end
    if index == status_match.size - 1
      event.set("http-rc", states)
    end
  end
  ## Match RespReason
  response_reason = items.grep(/(Bereq|Req|Beresp|Resp)Reason/)
  reasons = []
  response_reason.each_with_index do |reason, index|
    if match = /-+\s+(Bereq|Req|Beresp|Resp)Reason\s+(?<reason>.+)/.match(reason)
      reasons.push(match['reason'])
    end
    if index == response_reason.size - 1
      event.set("reason", reasons)
    end
  end

  if @message
    # Replace the event message with our message as configured in the
    # config file.
    event.set("message", @message)
  end

  # filter_matched should go in the last line of our successful code
  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/varnishlog.rb, line 35
def register
  # Add instance variables
end

Private Instance Methods

normalize_fields(name) click to toggle source
# File lib/logstash/filters/varnishlog.rb, line 142
def normalize_fields(name)
  name.capitalize.gsub(/[_-](\w)/){$1.upcase} if @normalize_fieldnames
end