class LogStash::Filters::Advisor

send_first => true Means you can push out the first events different who came in advisor like clone copy and tagged with “advisor_first”

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/advisor.rb, line 86
def filter(event)
 return unless filter?(event)
 
 # Control the correct config
 if(!(@time_adv == 0))

   new_event = true
   @message = event["message"]
   
   # control if the events are new or they are came before
   for i in (0..@sarray.size-1)
     if (@message == @sarray[i].to_s)
       @logger.debug("Avisor: Event match")
       # if came before then count it
       new_event = false
       @carray[i] = @carray[i].to_i+1
       @logger.debug("Advisor: "+@carray[i].to_s+" Events matched")
       break
     end
   end
    
   if (new_event == true)
      # else is a new event

      @sarray << @message
      @carray << 1
      if (send_first == true)
          @logger.debug("Advisor: is the first to send out")
          @first = true
      end
   end
    
 else
  @logger.warn("Advisor: you have not specified Time_adv. This filter will do nothing!")
 end
end
flush() click to toggle source

This method is used for generate events every 5 seconds (Thanks Jordan Sissel for explanation). In this case we generate an event when advisor thread trigger the flag or is the first different event.

# File lib/logstash/filters/advisor.rb, line 127
def flush
    
      if (@first == true)
        event = LogStash::Event.new
        event["host"] = Socket.gethostname
        event["message"] = @message
        event.tag "advisor_first"
        filter_matched(event)
       
        @first = false
        return [event]
      end
 
       if (@flag == true)
 
        if (@tags.size != 0)
          @tag_path = ""
          for i in (0..@tags.size-1)
            @tag_path += @tags[i].to_s+"."
          end
        end
          
        # Prepare message
        message = "Advisor: Found events who match: "+@tag_path.to_s+"\n\n"

        # See on messagge partial part of different events
        for i in (0..@sarray.size-1)
          message = message+@carray[i].to_s+" events like: "+(@sarray[i].to_s).slice(0, 300)+"\n\n"
        end
       
        event = LogStash::Event.new
        event["host"] = Socket.gethostname 
        event["message"] = message  
        event.tag << "advisor_info"
        filter_matched(event)
 
        # reset flag and counter
        @flag = false
        @carray = nil
        @sarray = nil
        @carray = Array.new
        @sarray = Array.new

        # push the event
        return [event]
       end
  return
 
end
register() click to toggle source
# File lib/logstash/filters/advisor.rb, line 48
def register

 # Control the correct config
 if (!(@time_adv == 0))
   
   @flag = false
   @first = false
   # Is used for store the different events.
   @sarray = Array.new
   # Is used for count the number of equals events.
   @carray = Array.new

   @thread = time_alert(@time_adv.to_i*60) do
    # if collected any events then pushed out a new event after time_adv
    if (@sarray.size !=0) 
       @flag = true
    end
   end
 
 else
  @logger.warn("Advisor: you have not specified Time_adv. This filter will do nothing!")
 end

end
time_alert(interval) { || ... } click to toggle source

This method is used to manage sleep and awaken threads (thanks StackOverflow for the support)

# File lib/logstash/filters/advisor.rb, line 74
def time_alert(interval)
   Thread.new do
    loop do
     start_time = Time.now
     yield
     elapsed = Time.now - start_time
     sleep([interval - elapsed, 0].max)
   end
 end
end