Class: LogStash::Filters::Date

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/date.rb

Instance Attribute Summary

Attributes inherited from Base

#logger

Instance Method Summary collapse

Methods inherited from Base

#add_config

Constructor Details

#initialize(config = {}) ⇒ Date

Returns a new instance of Date.



21
22
23
24
25
 
# File 'lib/logstash/filters/date.rb', line 21

def initialize(config = {})
  super

  @types = Hash.new { |h,k| h[k] = [] }
end

Instance Method Details

#filter(event) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/logstash/filters/date.rb', line 37

def filter(event)
  @logger.debug "DATE FILTER: received event of type #{event.type}"
  return unless @types.member?(event.type)
  @types[event.type].each do |field, format|
    @logger.debug "DATE FILTER: type #{event.type}, looking for field #{field.inspect} with format #{format.inspect}"
    # TODO(sissel): check event.message, too.
    if event.fields.member?(field)
      fieldvalue = event.fields[field]
      fieldvalue = [fieldvalue] if fieldvalue.is_a?(String)
      fieldvalue.each do |value|
        next if value == ""
        begin
          case format
            when "ISO8601"
              time = DateTime.parse(value)
            else
              time = DateTime.strptime(value, format)
          end
          event.timestamp = LogStash::Time.to_iso8601(time)
          @logger.debug "Parsed #{value.inspect} as #{event.timestamp}"
        rescue => e
          @logger.warn "Failed parsing date #{value.inspect} from field #{field} with format #{format.inspect}: #{e}"
        end
      end # fieldvalue.each 
    end # if this event has a field we expect to be a timestamp
  end # @types[event.type].each
end

#register ⇒ Object 



28
29
30
31
32
33
34
 
# File 'lib/logstash/filters/date.rb', line 28

def register
  @config.each do |type, typeconfig|
    @logger.debug "Setting type #{type.inspect} to the config #{typeconfig.inspect}"
    raise "date filter type \"#{type}\" defined more than once" unless @types[type].empty?
    @types[type] = typeconfig
  end # @config.each
end