class LogStash::Filters::Advisor
send_first => true Means you can push out the first events different who came in advisor like clone copy and tagged with “advisor_first”
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/advisor.rb, line 86 def filter(event) return unless filter?(event) # Control the correct config if(!(@time_adv == 0)) new_event = true @message = event["message"] # control if the events are new or they are came before for i in (0..@sarray.size-1) if (@message == @sarray[i].to_s) @logger.debug("Avisor: Event match") # if came before then count it new_event = false @carray[i] = @carray[i].to_i+1 @logger.debug("Advisor: "+@carray[i].to_s+" Events matched") break end end if (new_event == true) # else is a new event @sarray << @message @carray << 1 if (send_first == true) @logger.debug("Advisor: is the first to send out") @first = true end end else @logger.warn("Advisor: you have not specified Time_adv. This filter will do nothing!") end end
flush()
click to toggle source
This method is used for generate events every 5 seconds (Thanks Jordan Sissel for explanation). In this case we generate an event when advisor thread trigger the flag or is the first different event.
# File lib/logstash/filters/advisor.rb, line 127 def flush if (@first == true) event = LogStash::Event.new event["host"] = Socket.gethostname event["message"] = @message event.tag "advisor_first" filter_matched(event) @first = false return [event] end if (@flag == true) if (@tags.size != 0) @tag_path = "" for i in (0..@tags.size-1) @tag_path += @tags[i].to_s+"." end end # Prepare message message = "Advisor: Found events who match: "+@tag_path.to_s+"\n\n" # See on messagge partial part of different events for i in (0..@sarray.size-1) message = message+@carray[i].to_s+" events like: "+(@sarray[i].to_s).slice(0, 300)+"\n\n" end event = LogStash::Event.new event["host"] = Socket.gethostname event["message"] = message event.tag << "advisor_info" filter_matched(event) # reset flag and counter @flag = false @carray = nil @sarray = nil @carray = Array.new @sarray = Array.new # push the event return [event] end return end
register()
click to toggle source
# File lib/logstash/filters/advisor.rb, line 48 def register # Control the correct config if (!(@time_adv == 0)) @flag = false @first = false # Is used for store the different events. @sarray = Array.new # Is used for count the number of equals events. @carray = Array.new @thread = time_alert(@time_adv.to_i*60) do # if collected any events then pushed out a new event after time_adv if (@sarray.size !=0) @flag = true end end else @logger.warn("Advisor: you have not specified Time_adv. This filter will do nothing!") end end
time_alert(interval) { || ... }
click to toggle source
This method is used to manage sleep and awaken threads (thanks StackOverflow for the support)
# File lib/logstash/filters/advisor.rb, line 74 def time_alert(interval) Thread.new do loop do start_time = Time.now yield elapsed = Time.now - start_time sleep([interval - elapsed, 0].max) end end end