class LogStash::Filters::Json

JSON filter. Takes a field that contains JSON and expands it into an actual datastructure.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/json.rb, line 50
def filter(event)
  return unless filter?(event)

  @logger.debug("Running json filter", :event => event)

  return unless event.include?(@source)

  if @target.nil?
    # Default is to write to the root of the event.
    dest = event.to_hash
  else
    dest = event[@target] ||= {}
  end

  begin
    # TODO(sissel): Note, this will not successfully handle json lists
    # like your text is '[ 1,2,3 ]' JSON.parse gives you an array (correctly)
    # which won't merge into a hash. If someone needs this, we can fix it
    # later.
    dest.merge!(JSON.parse(event[@source]))

    # This is a hack to help folks who are mucking with @timestamp during
    # their json filter. You aren't supposed to do anything with "@timestamp"
    # outside of the date filter, but nobody listens... ;)
    if event["@timestamp"].is_a?(String)
      event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime
    end

    filter_matched(event)
  rescue => e
    event.tag("_jsonparsefailure")
    @logger.warn("Trouble parsing json", :source => @source,
                 :raw => event[@source], :exception => e)
    return
  end

  @logger.debug("Event after json filter", :event => event)

end
register() click to toggle source
# File lib/logstash/filters/json.rb, line 45
def register
  # Nothing to do here
end