class LogStash::Event

General event type. Will expand this in the future.

Public Class Methods

from_json(json) click to toggle source
# File lib/logstash/event.rb, line 24
def self.from_json(json)
  return LogStash::Event.new(JSON.parse(json))
end
new(data=Hash.new) click to toggle source
# File lib/logstash/event.rb, line 9
def initialize(data=Hash.new)
  @cancelled = false
  @data = {
    "@source" => "unknown",
    "@type" => nil,
    "@tags" => [],
    "@fields" => {},
  }.merge(data)

  if !@data.include?("@timestamp")
    @data["@timestamp"] = LogStash::Time.now.utc.to_iso8601
  end
end

Public Instance Methods

==(other) click to toggle source
# File lib/logstash/event.rb, line 146
def ==(other)
  puts "#{self.class.name}#==(#{other.inspect})"
  if !other.is_a?(self.class)
    return false
  end

  return other.to_hash == self.to_hash
end
[](key) click to toggle source

field-related access

# File lib/logstash/event.rb, line 73
def [](key)
  # If the key isn't in fields and it starts with an "@" sign, get it out of data instead of fields
  if ! @data["@fields"].has_key?(key) and key.slice(0,1) == "@"
    return @data[key]
  # Exists in @fields (returns value) or doesn't start with "@" (return null)
  else
    return @data["@fields"][key]
  end
end
[]=(key, value) click to toggle source

TODO(sissel): the semantics of [] and []= are now different in that []= only allows you to assign to only fields (not metadata), but

allows you to read fields and metadata.

We should fix this. Metadata is really a namespace issue, anyway.

# File lib/logstash/event.rb, line 87
def []=(key, value); @data["@fields"][key] = value end
append(event) click to toggle source

Append an event to this one.

# File lib/logstash/event.rb, line 104
def append(event)
  self.message += "\n" + event.message 
  self.tags |= event.tags

  # Append all fields
  event.fields.each do |name, value|
    if self.fields.include?(name)
      puts "Merging field #{name}"
      self.fields[name] |= value
    else
      puts "Setting field #{name}"
      self.fields[name] = value
    end
  end # event.fields.each
end
cancel() click to toggle source
# File lib/logstash/event.rb, line 29
def cancel
  @cancelled = true
end
cancelled?() click to toggle source
# File lib/logstash/event.rb, line 34
def cancelled?
  return @cancelled
end
fields() click to toggle source
# File lib/logstash/event.rb, line 88
def fields; return @data["@fields"] end
include?(key) click to toggle source
# File lib/logstash/event.rb, line 100
def include?(key); return @data.include?(key) end
message() click to toggle source
# File lib/logstash/event.rb, line 60
def message; @data["@message"]; end
message=(val) click to toggle source
# File lib/logstash/event.rb, line 61
def message=(val); @data["@message"] = val; end
overwrite(event) click to toggle source
# File lib/logstash/event.rb, line 95
def overwrite(event)
  @data = event.to_hash
end
source() click to toggle source
# File lib/logstash/event.rb, line 48
def source; @data["@source"]; end
source=(val) click to toggle source
# File lib/logstash/event.rb, line 49
def source=(val) 
  if val.is_a?(URI)
    @data["@source"] = val.to_s
    @data["@source_host"] = val.host
    @data["@source_path"] = val.path
  else
    @data["@source"] = val
  end
end
sprintf(format) click to toggle source

sprintf. This could use a better method name. The idea is to take an event and convert it to a string based on any format values, delimited by ${foo} where 'foo' is a field or metadata member.

For example, if the event has @type == “foo” and @source == “bar” then this string:

"type is ${@type} and source is #{@source}"

will return

"type is foo and source is bar"

If a ${name} value does not exist, then no substitution occurs.

TODO(sissel): It is not clear what the value of a field that is an array (or hash?) should be. Join by comma? Something else?

# File lib/logstash/event.rb, line 136
def sprintf(format)
  result = format.gsub(/\$\{[@A-Za-z0-9_-]+\}/) do |match|
    name = match[2..-2] # trim '${' and '}'
    value = (self[name] or match)
  end
  #$stderr.puts "sprintf(#{format.inspect}) => #{result.inspect}"
  return result
end
tags() click to toggle source
# File lib/logstash/event.rb, line 68
def tags; @data["@tags"]; end
tags=(val) click to toggle source
# File lib/logstash/event.rb, line 69
def tags=(val); @data["@tags"] = val; end
timestamp() click to toggle source
# File lib/logstash/event.rb, line 44
def timestamp; @data["@timestamp"]; end
timestamp=(val) click to toggle source
# File lib/logstash/event.rb, line 45
def timestamp=(val); @data["@timestamp"] = val; end
to_hash() click to toggle source
# File lib/logstash/event.rb, line 92
def to_hash; return @data end
to_json() click to toggle source
# File lib/logstash/event.rb, line 91
def to_json; return @data.to_json end
to_s() click to toggle source
# File lib/logstash/event.rb, line 39
def to_s
  return "#{timestamp} #{source}: #{message}"
end
type() click to toggle source
# File lib/logstash/event.rb, line 64
def type; @data["@type"]; end
type=(val) click to toggle source
# File lib/logstash/event.rb, line 65
def type=(val); @data["@type"] = val; end