class LogStash::Filters::Date
The date filter is used for parsing dates from fields, and then using that date or timestamp as the logstash timestamp for the event.
For example, syslog events usually have timestamps like this:
- source,ruby
-
“Apr 17 09:32:01”
You would use the date format ‘MMM dd HH:mm:ss` to parse this.
The date filter is especially important for sorting events and for backfilling old data. If you don’t get the date correct in your event, then searching for them later will likely sort out of order.
In the absence of this filter, logstash will choose a timestamp based on the first time it sees the event (at input time), if the timestamp is not already set in the event. For example, with file input, the timestamp is set to the time of each read.
Public Class Methods
new(config = {})
click to toggle source
Calls superclass method
# File lib/logstash/filters/date.rb, line 157 def initialize(config = {}) super if @match.length < 2 raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register", :plugin => "filter", :type => "date", :error => "The match setting should contains first a field name and at least one date format, current value is #{@match}") end if @locale if @locale.include? '_' @logger.warn("Date filter now use BCP47 format for locale, replacing underscore with dash") @locale.gsub!('_','-') end locale = java.util.Locale.forLanguageTag(@locale) end source = @match.first success_block = Proc.new do |event| filter_matched(event) metric.increment(:matches) end failure_block = Proc.new do |event| metric.increment(:failures) end @datefilter = org.logstash.filters.DateFilter.new(source, @target, @tag_on_failure, success_block, failure_block) @match[1..-1].map do |format| @datefilter.accept_filter_config(format, @locale, @timezone) # Offer a fallback parser such that if the default system Locale is non-english and that no locale is set, # we should try to parse english if the first local parsing fails.:w if !@locale && "en" != java.util.Locale.getDefault().getLanguage() && (format.include?("MMM") || format.include?("E")) @datefilter.accept_filter_config(format, "en-US", @timezone) end end end
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/date.rb, line 200 def filter(event) multi_filter([event]).first end
multi_filter(events)
click to toggle source
# File lib/logstash/filters/date.rb, line 196 def multi_filter(events) @datefilter.receive(events) end
register()
click to toggle source
# File lib/logstash/filters/date.rb, line 153 def register # nothing end