class LogStash::Filters::Json
JSON filter. Takes a field that contains JSON and expands it into an actual datastructure.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/json.rb, line 50 def filter(event) return unless filter?(event) @logger.debug("Running json filter", :event => event) return unless event.include?(@source) if @target.nil? # Default is to write to the root of the event. dest = event.to_hash else dest = event[@target] ||= {} end begin # TODO(sissel): Note, this will not successfully handle json lists # like your text is '[ 1,2,3 ]' JSON.parse gives you an array (correctly) # which won't merge into a hash. If someone needs this, we can fix it # later. dest.merge!(JSON.parse(event[@source])) # This is a hack to help folks who are mucking with @timestamp during # their json filter. You aren't supposed to do anything with "@timestamp" # outside of the date filter, but nobody listens... ;) if event["@timestamp"].is_a?(String) event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime end filter_matched(event) rescue => e event.tag("_jsonparsefailure") @logger.warn("Trouble parsing json", :source => @source, :raw => event[@source], :exception => e) return end @logger.debug("Event after json filter", :event => event) end
register()
click to toggle source
# File lib/logstash/filters/json.rb, line 45 def register # Nothing to do here end