Class: LogStash::Filters::Grok

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/grok.rb

Instance Attribute Summary

Attributes inherited from Base

#logger

Instance Method Summary collapse

Methods inherited from Base

#add_config

Constructor Details

#initialize(config = {}) ⇒ Grok

Returns a new instance of Grok.



9
10
11
12
13
 
# File 'lib/logstash/filters/grok.rb', line 9

def initialize(config = {})
  super

  @grokpiles = {}
end

Instance Method Details

#filter(event) ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
 
# File 'lib/logstash/filters/grok.rb', line 34

def filter(event)
  # parse it with grok
  message = event.message
  match = false

  if event.type
    if @grokpiles.include?(event.type)
      @logger.debug(["Running grok filter", event])
      pile = @grokpiles[event.type]
      grok, match = pile.match(message)
    end # @grokpiles.include?(event.type)
    # TODO(2.0): support grok pattern discovery
  else
    @logger.info("Unknown type for #{event.source} (type: #{event.type})")
    @logger.debug(event.to_hash)
  end

  if match
    match.each_capture do |key, value|
      match_type = nil
      if key.include?(":")
        name, key, match_type = key.split(":")
      end

      # http://code.google.com/p/logstash/issues/detail?id=45
      # Permit typing of captures by giving an additional colon and a type,
      # like: %{FOO:name:int} for int coercion.
      case match_type
        when "int"
          value = value.to_i
        when "float"
          value = value.to_f
      end

      if event.message == value
        # Skip patterns that match the entire line
        @logger.debug("Skipping capture '#{key}' since it matches the whole line.")
        next
      end

      if event.fields[key].is_a?(String)
        event.fields[key] = [event.fields[key]]
      elsif event.fields[key] == nil
        event.fields[key] = []
      end

      # If value is not nil, or responds to empty and is not empty, add the
      # value to the event.
      if !value.nil? && (!value.empty? rescue true)
        event.fields[key] << value
      end
    end
  else
    # Tag this event if we can't parse it. We can use this later to
    # reparse+reindex logs if we improve the patterns given .
    event.tags << "_grokparsefailure"
  end

  @logger.debug(["Event now: ", event.to_hash])
end

#register ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 
# File 'lib/logstash/filters/grok.rb', line 16

def register
  # TODO(sissel): Make patterns files come from the config
  @config.each do |type, typeconfig|
    @logger.debug("Registering type with grok: #{type}")
    pile = Grok::Pile.new
    patterndir = "#{File.dirname(__FILE__)}/../../../patterns/*"
    Dir.glob(patterndir).each do |path|
      pile.add_patterns_from_file(path)
    end
    typeconfig["patterns"].each do |pattern|
      groks = pile.compile(pattern)
      @logger.debug(["Compiled pattern", pattern, groks[-1].expanded_pattern])
    end
    @grokpiles[type] = pile
  end # @config.each
end