Contents

# {
#   "index": {
#     "stamp": "",
#     "prefix": "",
#     "suffix": "",
#     "format": ""
#   }
# }
module Anschel
  class Filter
    def index conf, log
      stamp  = conf.delete(:stamp)  || '@timestamp'
      prefix = conf.delete(:prefix) || 'logs-%{type}-'
      suffix = conf.delete(:suffix) || '%Y.%m.%d'
      format = conf.delete(:format) || "yyyy-MM-dd'T'HH:mm:ss.SSSZZ" # ISO8601

      error_tag = conf.has_key?(:error_tag) ? conf[:error_tag] : 'index-error'

      stamp = stamp.to_sym

      joda = org.joda.time.format.DateTimeFormat.forPattern format
      joda = joda.withDefaultYear(Time.new.year)
      joda = joda.withOffsetParsed


      log.trace event: 'filter-compiled', kind: 'index', \
        stamp: stamp, prefix: prefix, suffix: suffix, format: format

      lambda do |event|
        return event unless event.has_key? stamp
        idx_prefix = prefix % event
        begin
          millis     = joda.parseMillis event[stamp]
          idx_suffix = Time.at(0.001 * millis).strftime(suffix)
          event[:_index] = idx_prefix + idx_suffix
          filtered event, conf
        rescue java.lang.IllegalArgumentException => e
          event[:_index] = idx_prefix + Time.now.strftime(suffix)
          log.warn \
            event: 'filter-index-warning',
            reason: 'could not parse event',
            remediation: 'added bogus index',
            remediation: "sending to best-guess index '#{event[:_index]}'",
            raw_event: event
          if error_tag
            event[:tags] ||= []
            event[:tags] << error_tag
          end
          filtered event, conf
        end
      end
    end
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
anschel-0.6.5	lib/anschel/filter/index.rb
anschel-0.6.4	lib/anschel/filter/index.rb
anschel-0.6.3	lib/anschel/filter/index.rb
anschel-0.6.2	lib/anschel/filter/index.rb