Class: LogStash::Filters::Split

Inherits:
Base show all
Defined in:
lib/logstash/filters/split.rb

Overview

The split filter is for splitting multiline messages into separate events.

An example use case of this filter is for taking output from the ‘exec’ input which emits one event for the whole output of a command and splitting that output by newline - making each line an event.

The end result of each split is a complete copy of the event with only the current split section of the given field changed.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/logstash/filters/split.rb', line 31

def filter(event)
  return unless filter?(event)

  events = []

  original_value = event[@field]

  # If for some reason the field is an array of values, take the first only.
  original_value = original_value.first if original_value.is_a?(Array)

  # Using -1 for 'limit' on String#split makes ruby not drop trailing empty
  # splits.
  splits = original_value.split(@terminator, -1)

  # Skip filtering if splitting this event resulted in only one thing found.
  return if splits.length == 1
  #or splits[1].empty?

  splits.each do |value|
    next if value.empty?

    event_split = event.clone
    @logger.debug("Split event", :value => value, :field => @field)
    event_split[@field] = value
    filter_matched(event_split)

    # Push this new event onto the stack at the LogStash::FilterWorker
    yield event_split
  end

  # Cancel this event, we'll use the newly generated ones above.
  event.cancel
end

#register ⇒ Object 



26
27
28
 
# File 'lib/logstash/filters/split.rb', line 26

def register
  # Nothing to do
end