line.rb in logstash-codec-line-3.1.0

- old
+ new

@@ -1,15 +1,22 @@
 # encoding: utf-8
 require "logstash/codecs/base"
 require "logstash/util/charset"
 
+require 'logstash/plugin_mixins/ecs_compatibility_support'
+require 'logstash/plugin_mixins/event_support/event_factory_adapter'
+
 # Line-oriented text data.
 #
 # Decoding behavior: Only whole line events will be emitted.
 #
 # Encoding behavior: Each event will be emitted with a trailing newline.
 class LogStash::Codecs::Line < LogStash::Codecs::Base
+
+  include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)
+  include LogStash::PluginMixins::EventSupport::EventFactoryAdapter
+
   config_name "line"
 
   # Set the desired text format for encoding.
   config :format, :validate => :string
 
@@ -23,30 +30,46 @@
   config :charset, :validate => ::Encoding.name_list, :default => "UTF-8"
 
   # Change the delimiter that separates lines
   config :delimiter, :validate => :string, :default => "\n"
 
+  def initialize(*params)
+    super
+
+    @original_field = ecs_select[disabled: nil, v1: '[event][original]']
+  end
+
   MESSAGE_FIELD = "message".freeze
 
   def register
     require "logstash/util/buftok"
     @buffer = FileWatch::BufferedTokenizer.new(@delimiter)
     @converter = LogStash::Util::Charset.new(@charset)
     @converter.logger = @logger
   end
 
   def decode(data)
-    @buffer.extract(data).each { |line| yield LogStash::Event.new(MESSAGE_FIELD => @converter.convert(line)) }
+    @buffer.extract(data).each { |line| yield new_event_from_line(line) }
   end
 
   def flush(&block)
     remainder = @buffer.flush
     if !remainder.empty?
-      block.call(LogStash::Event.new(MESSAGE_FIELD => @converter.convert(remainder)))
+      block.call new_event_from_line(remainder)
     end
   end
 
   def encode(event)
     encoded = @format ? event.sprintf(@format) : event.to_s
     @on_event.call(event, encoded + @delimiter)
   end
+
+  private
+
+  def new_event_from_line(line)
+    message = @converter.convert(line)
+    event = event_factory.new_event MESSAGE_FIELD => message
+    event.set @original_field, message.dup.freeze if @original_field
+    event
+  end
+
 end