Class: Fluent::Plugin::SplunkParser

Inherits:
Parser
  • Object
show all
Defined in:
lib/fluent/plugin/parser_splunk_parser.rb

Instance Method Summary collapse

Instance Method Details

#configure(conf) ⇒ Object 



26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/fluent/plugin/parser_splunk_parser.rb', line 26

def configure(conf)
  super

  if @delimiter.length != 1
    raise ConfigError, "delimiter must be a single character. #{@delimiter} is not."
  end

  # TimeParser class is already given. It takes a single argument as the time format
  # to parse the time string with.
  @time_parser = Fluent::TimeParser.new(@time_format)
end

#parse(text) {|time, record| ... } ⇒ Object

Yields:

  • (time, record) 


38
39
40
41
42
43
44
45
46
47
 
# File 'lib/fluent/plugin/parser_splunk_parser.rb', line 38

def parse(text)
  time, key_values = text.split(@delimiter, 2)
  time = @time_parser.parse(time)
  record = {}
  key_values.split(@delimiter).each { |kv|
    k, v = kv.split("=", 2)
    record[k] = v
  }
  yield time, record
end