Sha256: 7c2574f4e6d3fd67a597d9a79cc76b0e80db4447b568a6411eae6069b22c2ee9

Contents?: true

Size: 1.92 KB

Versions: 16

Compression:

Stored size: 1.92 KB

Contents

require "logstash/filters/base"

gem "jls-grok", ">=0.2.3071"
require "grok" # rubygem 'jls-grok'

class LogStash::Filters::Grokdiscovery < LogStash::Filters::Base
  def initialize(config = {})
    super

    @discover_fields = {}
  end # def initialize

  def register
    # TODO(sissel): Make patterns files come from the config
    @config.each do |type, typeconfig|
      @logger.debug("Registering type with grok: #{type}")
      @grok = Grok.new
      Dir.glob("patterns/*").each do |path|
        @grok.add_patterns_from_file(path)
      end
      @discover_fields[type] = typeconfig
      @logger.debug(["Enabling discovery", { :type => type, :fields => typeconfig }])
      @logger.warn(@discover_fields)
    end # @config.each
  end # def register

  def filter(event)
    # parse it with grok
    message = event.message
    match = false

    if event.type and @discover_fields.include?(event.type)
      discover = @discover_fields[event.type] & event.fields.keys
      discover.each do |field|
        value = event.fields[field]
        value = [value] if value.is_a?(String)

        value.each do |v| 
          pattern = @grok.discover(v)
          @logger.warn("Trying #{v} => #{pattern}")
          @grok.compile(pattern)
          match = @grok.match(v)
          if match
            @logger.warn(["Match", match.captures])
            event.fields.merge!(match.captures) do |key, oldval, newval|
              @logger.warn(["Merging #{key}", oldval, newval])
              oldval + newval # should both be arrays...
            end
          else
            @logger.warn(["Discovery produced something not matchable?", { :input => v }])
          end
        end # value.each
      end # discover.each
    else
      @logger.info("Unknown type for #{event.source} (type: #{event.type})")
      @logger.debug(event.to_hash)
    end
    @logger.debug(["Event now: ", event.to_hash])
  end # def filter
end # class LogStash::Filters::Grokdiscovery

Version data entries

16 entries across 16 versions & 1 rubygems

Version Path
logstash-lite-0.2.20101222161646 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101208111718 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101207114354 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101201111523 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101129210156 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101129205551 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101129155412 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101124030048 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101124004656 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101123134625 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101123133737 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101120024757 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101120021802 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101119183130 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101118141920 lib/logstash/filters/grokdiscovery.rb
logstash-lite-0.2.20101118134500 lib/logstash/filters/grokdiscovery.rb