Sha256: 7c2574f4e6d3fd67a597d9a79cc76b0e80db4447b568a6411eae6069b22c2ee9
Contents?: true
Size: 1.92 KB
Versions: 16
Compression:
Stored size: 1.92 KB
Contents
require "logstash/filters/base" gem "jls-grok", ">=0.2.3071" require "grok" # rubygem 'jls-grok' class LogStash::Filters::Grokdiscovery < LogStash::Filters::Base def initialize(config = {}) super @discover_fields = {} end # def initialize def register # TODO(sissel): Make patterns files come from the config @config.each do |type, typeconfig| @logger.debug("Registering type with grok: #{type}") @grok = Grok.new Dir.glob("patterns/*").each do |path| @grok.add_patterns_from_file(path) end @discover_fields[type] = typeconfig @logger.debug(["Enabling discovery", { :type => type, :fields => typeconfig }]) @logger.warn(@discover_fields) end # @config.each end # def register def filter(event) # parse it with grok message = event.message match = false if event.type and @discover_fields.include?(event.type) discover = @discover_fields[event.type] & event.fields.keys discover.each do |field| value = event.fields[field] value = [value] if value.is_a?(String) value.each do |v| pattern = @grok.discover(v) @logger.warn("Trying #{v} => #{pattern}") @grok.compile(pattern) match = @grok.match(v) if match @logger.warn(["Match", match.captures]) event.fields.merge!(match.captures) do |key, oldval, newval| @logger.warn(["Merging #{key}", oldval, newval]) oldval + newval # should both be arrays... end else @logger.warn(["Discovery produced something not matchable?", { :input => v }]) end end # value.each end # discover.each else @logger.info("Unknown type for #{event.source} (type: #{event.type})") @logger.debug(event.to_hash) end @logger.debug(["Event now: ", event.to_hash]) end # def filter end # class LogStash::Filters::Grokdiscovery
Version data entries
16 entries across 16 versions & 1 rubygems