class LogStash::Filters::Translate

Originally written to translate HTTP response codes but turned into a general translation tool which uses configured has or/and .yaml files as a dictionary. response codes in default dictionary were scraped from 'gem install cheat; cheat status_codes'

Alternatively for simple string search and replacements for just a few values use the gsub function of the mutate filter.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/translate.rb, line 83
def filter(event)
  return unless filter?(event)

  return unless event.include?(@field) # Skip translation in case event does not have @event field.
  return if event.include?(@destination) and not @override # Skip translation in case @destination field already exists and @override is disabled.

  begin
    #If source field is array use first value and make sure source value is string
    source = event[@field].is_a?(Array) ? event[@field].first.to_s : event[@field].to_s
    matched = false
    if @exact
      if @regex
        key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))}
        if key
          event[@destination] = @dictionary[key]
          matched = true
        end
      elsif @dictionary.include?(source)
        event[@destination] = @dictionary[source]
        matched = true
      end
    else 
      translation = source.gsub(Regexp.union(@dictionary.keys), @dictionary)
      if source != translation
        event[@destination] = translation
        matched = true
      end
    end

    if not matched and @fallback
      event[@destination] = @fallback
      matched = true
    end
    filter_matched(event) if matched or @field == @destination
  rescue Exception => e
    @logger.error("Something went wrong when attempting to translate from dictionary", :exception => e, :field => @field, :event => event)
  end
end
register() click to toggle source
# File lib/logstash/filters/translate.rb, line 64
def register
  if @dictionary_path
    raise "#{self.class.name}: dictionary file #{@dictionary_path} does not exists" unless File.exists?(@dictionary_path)
    begin
      @dictionary.merge!(YAML.load_file(@dictionary_path))
    rescue Exception => e
      raise "#{self.class.name}: Bad Syntax in dictionary file #{@dictionary_path}"
    end
  end
  
  @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
  if @exact
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Exact")
  else
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Fuzzy")
  end
end