class LogStash::Filters::Translate
Originally written to translate HTTP response codes but turned into a general translation tool which uses configured has or/and .yaml files as a dictionary. response codes in default dictionary were scraped from 'gem install cheat; cheat status_codes'
Alternatively for simple string search and replacements for just a few values use the gsub function of the mutate filter.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/translate.rb, line 83 def filter(event) return unless filter?(event) return unless event.include?(@field) # Skip translation in case event does not have @event field. return if event.include?(@destination) and not @override # Skip translation in case @destination field already exists and @override is disabled. begin #If source field is array use first value and make sure source value is string source = event[@field].is_a?(Array) ? event[@field].first.to_s : event[@field].to_s matched = false if @exact if @regex key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))} if key event[@destination] = @dictionary[key] matched = true end elsif @dictionary.include?(source) event[@destination] = @dictionary[source] matched = true end else translation = source.gsub(Regexp.union(@dictionary.keys), @dictionary) if source != translation event[@destination] = translation matched = true end end if not matched and @fallback event[@destination] = @fallback matched = true end filter_matched(event) if matched or @field == @destination rescue Exception => e @logger.error("Something went wrong when attempting to translate from dictionary", :exception => e, :field => @field, :event => event) end end
register()
click to toggle source
# File lib/logstash/filters/translate.rb, line 64 def register if @dictionary_path raise "#{self.class.name}: dictionary file #{@dictionary_path} does not exists" unless File.exists?(@dictionary_path) begin @dictionary.merge!(YAML.load_file(@dictionary_path)) rescue Exception => e raise "#{self.class.name}: Bad Syntax in dictionary file #{@dictionary_path}" end end @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary) if @exact @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Exact") else @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Fuzzy") end end