class LogStash::Filters::Prune
The prune filter is for pruning event data from @fileds based on whitelist/blacklist of field names or their values (names and values can also be regular expressions).
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/prune.rb, line 80 def filter(event) return unless filter?(event) hash = event.to_hash # We need to collect fields which needs to be remove ,and only in the end # actually remove it since then interpolation mode you can get unexpected # results as fields with dynamic values will not match since the fields to # which they refer have already been removed. fields_to_remove = [] unless @whitelist_names.empty? @whitelist_names_regexp = Regexp.union(@whitelist_names.map {|x| Regexp.new(event.sprintf(x))}) if @interpolate hash.each_key do |field| fields_to_remove << field unless field.match(@whitelist_names_regexp) end end unless @blacklist_names.empty? @blacklist_names_regexp = Regexp.union(@blacklist_names.map {|x| Regexp.new(event.sprintf(x))}) if @interpolate hash.each_key do |field| fields_to_remove << field if field.match(@blacklist_names_regexp) end end @whitelist_values.each do |key, value| if @interpolate key = event.sprintf(key) value = Regexp.new(event.sprintf(value)) end if hash[key] if hash[key].is_a?(Array) subvalues_to_remove = hash[key].find_all{|x| not x.match(value)} unless subvalues_to_remove.empty? fields_to_remove << (subvalues_to_remove.length == hash[key].length ? key : { :key => key, :values => subvalues_to_remove }) end else fields_to_remove << key if not hash[key].match(value) end end end @blacklist_values.each do |key, value| if @interpolate key = event.sprintf(key) value = Regexp.new(event.sprintf(value)) end if hash[key] if hash[key].is_a?(Array) subvalues_to_remove = hash[key].find_all{|x| x.match(value)} unless subvalues_to_remove.empty? fields_to_remove << (subvalues_to_remove.length == hash[key].length ? key : { :key => key, :values => subvalues_to_remove }) end else fields_to_remove << key if hash[key].match(value) end end end fields_to_remove.each do |field| if field.is_a?(Hash) hash[field[:key]] = hash[field[:key]] - field[:values] else hash.delete(field) end end filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/prune.rb, line 66 def register unless @interpolate @whitelist_names_regexp = Regexp.union(@whitelist_names.map {|x| Regexp.new(x)}) @blacklist_names_regexp = Regexp.union(@blacklist_names.map {|x| Regexp.new(x)}) @whitelist_values.each do |key, value| @whitelist_values[key] = Regexp.new(value) end @blacklist_values.each do |key, value| @blacklist_values[key] = Regexp.new(value) end end end