Contents

require "fluent/plugin/filter"
require "json"
require "pp"
module Fluent
  module Plugin
    class DockergelfFilter < Fluent::Plugin::Filter
      Fluent::Plugin.register_filter("dockergelf", self)

      def configure(conf)
        super
      end

      def filter_with_time(tag, time, record)
        record["logtime"] = Time.at(time.to_f).iso8601(3).to_s
        content = record["log"].strip
        rettime = time
        if (content =~ /^[{](.*)[}]$/)
          content_hash = JSON.parse(content)
          if content_hash["version"].to_s == "1.1" && content_hash["short_message"] != nil #check if gelf format
            content_hash.delete("version")
            msg = content_hash["short_message"]
            content_hash.delete("short_message")
            content_hash.each do |key ,value|
              if key == "timestamp"
                rettime = Fluent::EventTime.from_time(Time.at(value))
              else
                record[key]=value
              end
            end
            record["log"] = msg
          end
        end
      rescue
      ensure
        # puts "returning "+ (Time.at(rettime.to_f).iso8601(3).to_s )+" "+record.to_s
        return rettime, record
      end
    end
  end
end

Version data entries

1 entries across 1 versions & 1 rubygems

Version	Path
fluent-plugin-dockergelf-0.2.2	lib/fluent/plugin/filter_dockergelf.rb