Contents

# encoding: utf-8
require "logstash/codecs/base"
require "logstash/json"

class LogStash::Codecs::OldLogStashJSON < LogStash::Codecs::Base
  config_name "oldlogstashjson"
  milestone 2

  # Map from v0 name to v1 name.
  # Note: @source is gone and has no similar field.
  V0_TO_V1 = {"@timestamp" => "@timestamp", "@message" => "message",
              "@tags" => "tags", "@type" => "type",
              "@source_host" => "host", "@source_path" => "path"}

  public
  def decode(data)
    begin
      obj = LogStash::Json.load(data.force_encoding(Encoding::UTF_8))
    rescue LogStash::Json::ParserError => e
      @logger.info("JSON parse failure. Falling back to plain-text", :error => e, :data => data)
      yield LogStash::Event.new("message" => data)
      return
    end

    h  = {}

    # Convert the old logstash schema to the new one.
    V0_TO_V1.each do |key, val|
      h[val] = obj[key] if obj.include?(key)
    end

    h.merge!(obj["@fields"]) if obj["@fields"].is_a?(Hash)
    yield LogStash::Event.new(h)
  end # def decode

  public
  def encode(event)
    h  = {}

    # Convert the new logstash schema to the old one.
    V0_TO_V1.each do |key, val|
      h[key] = event[val] if event.include?(val)
    end

    event.to_hash.each do |field, val|
      # TODO: might be better to V1_TO_V0 = V0_TO_V1.invert during
      # initialization than V0_TO_V1.has_value? within loop
      next if field == "@version" or V0_TO_V1.has_value?(field)
      h["@fields"] ||= {}
      h["@fields"][field] = val
    end

    # Tack on a \n because JSON outputs 1.1.x had them.
    @on_event.call(LogStash::Json.dump(h) + NL)
  end # def encode

end # class LogStash::Codecs::OldLogStashJSON

Version data entries

3 entries across 3 versions & 1 rubygems

Version	Path
logstash-codec-oldlogstashjson-0.1.2	lib/logstash/codecs/oldlogstashjson.rb
logstash-codec-oldlogstashjson-0.1.1	lib/logstash/codecs/oldlogstashjson.rb
logstash-codec-oldlogstashjson-0.1.0	lib/logstash/codecs/oldlogstashjson.rb