class LogStash::Filters::Prune

The prune filter is for pruning event data from @fileds based on whitelist/blacklist of field names or their values (names and values can also be regular expressions).

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/prune.rb, line 80
def filter(event)
  return unless filter?(event)

  hash = event.to_hash

  # We need to collect fields which needs to be remove ,and only in the end
  # actually remove it since then interpolation mode you can get unexpected
  # results as fields with dynamic values will not match since the fields to
  # which they refer have already been removed.
  fields_to_remove = []

  unless @whitelist_names.empty?
    @whitelist_names_regexp = Regexp.union(@whitelist_names.map {|x| Regexp.new(event.sprintf(x))}) if @interpolate
    hash.each_key do |field|
      fields_to_remove << field unless field.match(@whitelist_names_regexp)
    end
  end

  unless @blacklist_names.empty?
    @blacklist_names_regexp = Regexp.union(@blacklist_names.map {|x| Regexp.new(event.sprintf(x))}) if @interpolate
    hash.each_key do |field|
      fields_to_remove << field if field.match(@blacklist_names_regexp)
    end
  end

  @whitelist_values.each do |key, value|
    if @interpolate
      key = event.sprintf(key)
      value = Regexp.new(event.sprintf(value))
    end
    if hash[key]
      if hash[key].is_a?(Array)
        subvalues_to_remove = hash[key].find_all{|x| not x.match(value)}
        unless subvalues_to_remove.empty?
          fields_to_remove << (subvalues_to_remove.length == hash[key].length ? key : { :key => key, :values => subvalues_to_remove })
        end
      else
        fields_to_remove << key if not hash[key].match(value)
      end
    end
  end

  @blacklist_values.each do |key, value|
    if @interpolate
      key = event.sprintf(key)
      value = Regexp.new(event.sprintf(value))
    end
    if hash[key]
      if hash[key].is_a?(Array)
        subvalues_to_remove = hash[key].find_all{|x| x.match(value)}
        unless subvalues_to_remove.empty?
          fields_to_remove << (subvalues_to_remove.length == hash[key].length ? key : { :key => key, :values => subvalues_to_remove })
        end
      else
        fields_to_remove << key if hash[key].match(value)
      end
    end
  end

  fields_to_remove.each do |field|
    if field.is_a?(Hash)
      hash[field[:key]] = hash[field[:key]] - field[:values]
    else
      hash.delete(field)
    end
  end

  filter_matched(event)
end
register() click to toggle source
# File lib/logstash/filters/prune.rb, line 66
def register
  unless @interpolate
    @whitelist_names_regexp = Regexp.union(@whitelist_names.map {|x| Regexp.new(x)})
    @blacklist_names_regexp = Regexp.union(@blacklist_names.map {|x| Regexp.new(x)})
    @whitelist_values.each do |key, value|
      @whitelist_values[key] = Regexp.new(value)
    end
    @blacklist_values.each do |key, value|
      @blacklist_values[key] = Regexp.new(value)
    end
  end
end