class LogStash::Filters::Grok
Public Class Methods
new(config = {})
click to toggle source
Calls superclass method
LogStash::Filters::Base::new
# File lib/logstash/filters/grok.rb, line 9 def initialize(config = {}) super @grokpiles = {} end
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/grok.rb, line 34 def filter(event) # parse it with grok message = event.message match = false if event.type if @grokpiles.include?(event.type) @logger.debug(["Running grok filter", event]) pile = @grokpiles[event.type] grok, match = pile.match(message) end # @grokpiles.include?(event.type) # TODO(2.0): support grok pattern discovery else @logger.info("Unknown type for #{event.source} (type: #{event.type})") @logger.debug(event.to_hash) end if match match.each_capture do |key, value| match_type = nil if key.include?(":") name, key, match_type = key.split(":") end # http://code.google.com/p/logstash/issues/detail?id=45 # Permit typing of captures by giving an additional colon and a type, # like: %{FOO:name:int} for int coercion. case match_type when "int" value = value.to_i when "float" value = value.to_f end if event.message == value # Skip patterns that match the entire line @logger.debug("Skipping capture '#{key}' since it matches the whole line.") next end if event.fields[key].is_a?(String) event.fields[key] = [event.fields[key]] elsif event.fields[key] == nil event.fields[key] = [] end # If value is not nil, or responds to empty and is not empty, add the # value to the event. if !value.nil? && (!value.empty? rescue true) event.fields[key] << value end end else # Tag this event if we can't parse it. We can use this later to # reparse+reindex logs if we improve the patterns given . event.tags << "_grokparsefailure" end @logger.debug(["Event now: ", event.to_hash]) end
register()
click to toggle source
# File lib/logstash/filters/grok.rb, line 16 def register # TODO(sissel): Make patterns files come from the config @config.each do |type, typeconfig| @logger.debug("Registering type with grok: #{type}") pile = Grok::Pile.new patterndir = "#{File.dirname(__FILE__)}/../../../patterns/*" Dir.glob(patterndir).each do |path| pile.add_patterns_from_file(path) end typeconfig["patterns"].each do |pattern| groks = pile.compile(pattern) @logger.debug(["Compiled pattern", pattern, groks[-1].expanded_pattern]) end @grokpiles[type] = pile end # @config.each end