class LogStash::Filters::Date

The date filter is used for parsing dates from fields, and then using that date or timestamp as the logstash timestamp for the event.

For example, syslog events usually have timestamps like this:

source,ruby

“Apr 17 09:32:01”

You would use the date format ‘MMM dd HH:mm:ss` to parse this.

The date filter is especially important for sorting events and for backfilling old data. If you don’t get the date correct in your event, then searching for them later will likely sort out of order.

In the absence of this filter, logstash will choose a timestamp based on the first time it sees the event (at input time), if the timestamp is not already set in the event. For example, with file input, the timestamp is set to the time of each read.

Public Class Methods

new(config = {}) click to toggle source
Calls superclass method
# File lib/logstash/filters/date.rb, line 157
def initialize(config = {})
  super
  if @match.length < 2
    raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register",
      :plugin => "filter", :type => "date",
      :error => "The match setting should contains first a field name and at least one date format, current value is #{@match}")
  end
  if @locale
    if @locale.include? '_'
      @logger.warn("Date filter now use BCP47 format for locale, replacing underscore with dash")
      @locale.gsub!('_','-')
    end
    locale = java.util.Locale.forLanguageTag(@locale)
  end

  source = @match.first

  success_block = Proc.new do |event|
    filter_matched(event)
    metric.increment(:matches)
  end
  failure_block = Proc.new do |event|
    metric.increment(:failures)
  end

  @datefilter = org.logstash.filters.DateFilter.new(source, @target, @tag_on_failure, success_block, failure_block)

  @match[1..-1].map do |format|
    @datefilter.accept_filter_config(format, @locale, @timezone)

    # Offer a fallback parser such that if the default system Locale is non-english and that no locale is set,
    # we should try to parse english if the first local parsing fails.:w
    if !@locale && "en" != java.util.Locale.getDefault().getLanguage() && (format.include?("MMM") || format.include?("E"))
      @datefilter.accept_filter_config(format, "en-US", @timezone)
    end
  end

end

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/date.rb, line 200
def filter(event)
  multi_filter([event]).first
end
multi_filter(events) click to toggle source
# File lib/logstash/filters/date.rb, line 196
def multi_filter(events)
  @datefilter.receive(events)
end
register() click to toggle source
# File lib/logstash/filters/date.rb, line 153
def register
  # nothing
end