Contents

# {
#   "parse": {
#     "field": "message",
#     "pattern": "()"
#   }
# }
module Anschel
  class Filter
    def parse conf, log
      field   = conf.delete :field
      pattern = Regexp.new conf.delete(:pattern)

      raise 'Missing required "field" for "parse" filter' if field.nil?
      raise 'Missing required "pattern" for "parse" filter' if pattern.nil?

      field = field.to_sym


      log.trace event: 'filter-compiled', kind: 'parse', \
        field: field, pattern: pattern

      lambda do |event|
        return event unless event.has_key? field
        mdata = pattern.match event[field]
        if mdata.nil?
          log.error \
            event: 'parse-filter-error',
            reason: 'regexp did not match',
            field: field,
            pattern: pattern,
            raw_event: event
          return filtered(event, conf)
        end
        mdata.names.each do |group|
          event[group.to_sym] = mdata[group]
        end
        filtered event, conf
      end
    end
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
anschel-0.6.5	lib/anschel/filter/parse.rb
anschel-0.6.4	lib/anschel/filter/parse.rb
anschel-0.6.3	lib/anschel/filter/parse.rb
anschel-0.6.2	lib/anschel/filter/parse.rb