Contents

# {
#   "parse": {
#     "field": "message",
#     "pattern": "()"
#   }
# }
module Anschel
  class Filter
    def parse conf, stats, log
      field = conf.delete :field
      pattern = conf.delete(:pattern) || conf.delete(:patterns)
      unless_field = conf.delete(:unless_field) || '@timestamp'

      error_tag = conf.has_key?(:error_tag) ? conf[:error_tag] : 'parse-error'

      raise 'Missing required "field" for "parse" filter' if field.nil?
      raise 'Missing required "pattern" for "parse" filter' if pattern.nil?

      field = field.to_sym
      unless_field = unless_field.to_sym
      patterns = pattern.is_a?(Array) ? pattern : [ pattern ]
      patterns = patterns.map { |p| Regexp.new p }

      stats.create 'filter-parse'
      stats.create 'filter-parse-skipped'
      stats.create 'filter-parse-error'

      log.info event: 'filter-compiled', kind: 'parse', \
        field: field, patterns: patterns



      lambda do |event|
        unless event[field]
          stats.inc 'filter-parse-skipped'
          return event
        end

        if event[unless_field]
          stats.inc 'filter-parse-skipped'
          return event
        end

        mdata = nil
        patterns.each do |p|
          mdata = p.match event[field]
          break if mdata
        end

        if mdata.nil?
          log.warn \
            event: 'parse-filter-error',
            reason: 'regexp did not match',
            field: field,
            pattern: pattern,
            raw_event: event
          stats.inc 'filter-parse-error'
          if error_tag
            event[:tags] ||= []
            event[:tags] << error_tag
          end
          return event
        end

        mdata.names.each do |group|
          event[group.to_sym] = mdata[group]
        end

        stats.inc 'filter-parse'
        filtered event, conf
      end

    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
anschel-0.7.18	lib/anschel/filter/parse.rb