Sha256: a427f9eb75b1218f075eca47a07366807d408bb89d1f5a3845d5025f8351e147
Contents?: true
Size: 1.18 KB
Versions: 8
Compression:
Stored size: 1.18 KB
Contents
# encoding: utf-8
require "logstash/inputs/beats_support/event_transform_common"
module LogStash::Inputs::BeatsSupport
# Take the extracted content from the codec, merged with the other data coming
# from beats, apply the configured tags, normalize the host and try to coerce
# the timestamp if it was provided in the hash.
class DecodedEventTransform < EventTransformCommon
def transform(event, hash)
ts = coerce_ts(hash.delete("@timestamp"))
event["@timestamp"] = ts unless ts.nil?
hash.each { |k, v| event[k] = v }
super(event)
event.tag("beats_input_codec_#{@input.codec.base_codec.class.config_name}_applied")
event
end
private
def coerce_ts(ts)
return nil if ts.nil?
timestamp = LogStash::Timestamp.coerce(ts)
return timestamp if timestamp
@logger.warn("Unrecognized @timestamp value, setting current time to @timestamp",
:value => ts.inspect)
return nil
rescue LogStash::TimestampParserError => e
@logger.warn("Error parsing @timestamp string, setting current time to @timestamp",
:value => ts.inspect, :exception => e.message)
return nil
end
end
end
Version data entries
8 entries across 8 versions & 1 rubygems