class LogStash::Filters::Grokdiscovery
TODO(sissel): This is not supported yet. There is a bug in grok discovery that causes segfaults in libgrok.
Public Class Methods
new(config = {})
click to toggle source
Calls superclass method
LogStash::Filters::Base::new
# File lib/logstash/filters/grokdiscovery.rb, line 13 def initialize(config = {}) super @discover_fields = {} end
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/grokdiscovery.rb, line 38 def filter(event) return unless filter?(event) # parse it with grok message = event["message"] match = false if event.type and @discover_fields.include?(event.type) discover = @discover_fields[event.type] & event.to_hash.keys discover.each do |field| value = event[field] value = [value] if value.is_a?(String) value.each do |v| pattern = @grok.discover(v) @logger.warn("Trying #{v} => #{pattern}") @grok.compile(pattern) match = @grok.match(v) if match @logger.warn(["Match", match.captures]) event.to_hash.merge!(match.captures) do |key, oldval, newval| @logger.warn(["Merging #{key}", oldval, newval]) oldval + newval # should both be arrays... end else @logger.warn(["Discovery produced something not matchable?", { :input => v }]) end end # value.each end # discover.each else @logger.info("Unknown type for #{event.source} (type: #{event.type})") @logger.debug(event.to_hash) end @logger.debug(["Event now: ", event.to_hash]) filter_matched(event) if !event.cancelled? end
register()
click to toggle source
# File lib/logstash/filters/grokdiscovery.rb, line 20 def register gem "jls-grok", ">=0.4.3" require "grok" # rubygem 'jls-grok' # TODO(sissel): Make patterns files come from the config @config.each do |type, typeconfig| @logger.debug("Registering type with grok: #{type}") @grok = Grok.new Dir.glob("patterns/*").each do |path| @grok.add_patterns_from_file(path) end @discover_fields[type] = typeconfig @logger.debug(["Enabling discovery", { :type => type, :fields => typeconfig }]) @logger.warn(@discover_fields) end # @config.each end