class LogStash::Filters::Split
The split filter is for splitting multiline messages into separate events.
An example use case of this filter is for taking output from the 'exec' input which emits one event for the whole output of a command and splitting that output by newline - making each line an event.
The end result of each split is a complete copy of the event with only the current split section of the given field changed.
Public Instance Methods
filter(event) { |event_split| ... }
click to toggle source
# File lib/logstash/filters/split.rb, line 31 def filter(event) return unless filter?(event) events = [] original_value = event[@field] # If for some reason the field is an array of values, take the first only. original_value = original_value.first if original_value.is_a?(Array) # Using -1 for 'limit' on String#split makes ruby not drop trailing empty # splits. splits = original_value.split(@terminator, -1) # Skip filtering if splitting this event resulted in only one thing found. return if splits.length == 1 #or splits[1].empty? splits.each do |value| next if value.empty? event_split = event.clone @logger.debug("Split event", :value => value, :field => @field) event_split[@field] = value filter_matched(event_split) # Push this new event onto the stack at the LogStash::FilterWorker yield event_split end # Cancel this event, we'll use the newly generated ones above. event.cancel end
register()
click to toggle source
# File lib/logstash/filters/split.rb, line 26 def register # Nothing to do end