class LogStash::Event
General event type. Will expand this in the future.
Public Class Methods
# File lib/logstash/event.rb, line 24 def self.from_json(json) return LogStash::Event.new(JSON.parse(json)) end
# File lib/logstash/event.rb, line 9 def initialize(data=Hash.new) @cancelled = false @data = { "@source" => "unknown", "@type" => nil, "@tags" => [], "@fields" => {}, }.merge(data) if !@data.include?("@timestamp") @data["@timestamp"] = LogStash::Time.now.utc.to_iso8601 end end
Public Instance Methods
# File lib/logstash/event.rb, line 146 def ==(other) puts "#{self.class.name}#==(#{other.inspect})" if !other.is_a?(self.class) return false end return other.to_hash == self.to_hash end
field-related access
# File lib/logstash/event.rb, line 73 def [](key) # If the key isn't in fields and it starts with an "@" sign, get it out of data instead of fields if ! @data["@fields"].has_key?(key) and key.slice(0,1) == "@" return @data[key] # Exists in @fields (returns value) or doesn't start with "@" (return null) else return @data["@fields"][key] end end
TODO(sissel): the semantics of [] and []= are now different in that []= only allows you to assign to only fields (not metadata), but
-
allows you to read fields and metadata.
We should fix this. Metadata is really a namespace issue, anyway.
# File lib/logstash/event.rb, line 87 def []=(key, value); @data["@fields"][key] = value end
Append an event to this one.
# File lib/logstash/event.rb, line 104 def append(event) self.message += "\n" + event.message self.tags |= event.tags # Append all fields event.fields.each do |name, value| if self.fields.include?(name) puts "Merging field #{name}" self.fields[name] |= value else puts "Setting field #{name}" self.fields[name] = value end end # event.fields.each end
# File lib/logstash/event.rb, line 29 def cancel @cancelled = true end
# File lib/logstash/event.rb, line 34 def cancelled? return @cancelled end
# File lib/logstash/event.rb, line 88 def fields; return @data["@fields"] end
# File lib/logstash/event.rb, line 100 def include?(key); return @data.include?(key) end
# File lib/logstash/event.rb, line 60 def message; @data["@message"]; end
# File lib/logstash/event.rb, line 61 def message=(val); @data["@message"] = val; end
# File lib/logstash/event.rb, line 95 def overwrite(event) @data = event.to_hash end
# File lib/logstash/event.rb, line 48 def source; @data["@source"]; end
# File lib/logstash/event.rb, line 49 def source=(val) if val.is_a?(URI) @data["@source"] = val.to_s @data["@source_host"] = val.host @data["@source_path"] = val.path else @data["@source"] = val end end
sprintf. This could use a better method name. The idea is to take an event and convert it to a string based on any format values, delimited by ${foo} where 'foo' is a field or metadata member.
For example, if the event has @type == “foo” and @source == “bar” then this string:
"type is ${@type} and source is #{@source}"
will return
"type is foo and source is bar"
If a ${name} value does not exist, then no substitution occurs.
TODO(sissel): It is not clear what the value of a field that is an array (or hash?) should be. Join by comma? Something else?
# File lib/logstash/event.rb, line 136 def sprintf(format) result = format.gsub(/\$\{[@A-Za-z0-9_-]+\}/) do |match| name = match[2..-2] # trim '${' and '}' value = (self[name] or match) end #$stderr.puts "sprintf(#{format.inspect}) => #{result.inspect}" return result end
# File lib/logstash/event.rb, line 44 def timestamp; @data["@timestamp"]; end
# File lib/logstash/event.rb, line 45 def timestamp=(val); @data["@timestamp"] = val; end
# File lib/logstash/event.rb, line 92 def to_hash; return @data end
# File lib/logstash/event.rb, line 91 def to_json; return @data.to_json end
# File lib/logstash/event.rb, line 39 def to_s return "#{timestamp} #{source}: #{message}" end
# File lib/logstash/event.rb, line 64 def type; @data["@type"]; end
# File lib/logstash/event.rb, line 65 def type=(val); @data["@type"] = val; end