Sha256: 75d6a4f62e25f5e00524ec6d68d137c633b5765fbbbd4476b0c777d8f761b23c
Contents?: true
Size: 1.16 KB
Versions: 5
Compression:
Stored size: 1.16 KB
Contents
# encoding: utf-8
require "logstash/inputs/beats_support/event_transform_common"
module LogStash::Inputs::BeatsSupport
# Take the extracted content from the codec, merged with the other data coming
# from beats, apply the configured tags, normalize the host and try to coerce
# the timestamp if it was provided in the hash.
class DecodedEventTransform < EventTransformCommon
def transform(event, hash)
ts = coerce_ts(hash.delete("@timestamp"))
event.set("@timestamp", ts) unless ts.nil?
hash.each { |k, v| event.set(k, v) }
super(event)
event.tag("beats_input_codec_#{codec_name}_applied")
event
end
private
def coerce_ts(ts)
return nil if ts.nil?
timestamp = LogStash::Timestamp.coerce(ts)
return timestamp if timestamp
@logger.warn("Unrecognized @timestamp value, setting current time to @timestamp",
:value => ts.inspect)
return nil
rescue LogStash::TimestampParserError => e
@logger.warn("Error parsing @timestamp string, setting current time to @timestamp",
:value => ts.inspect, :exception => e.message)
return nil
end
end
end
Version data entries
5 entries across 5 versions & 1 rubygems