Class: LogStash::Event

Inherits:
Object
  • Object
show all
Defined in:
lib/logstash/event.rb

Overview

the logstash event object.

An event is simply a tuple of (timestamp, data). The ‘timestamp’ is an ISO8601 timestamp. Data is anything - any message, context, references, etc that are relevant to this event.

Internally, this is represented as a hash with only two guaranteed fields.

  • “@timestamp” - an ISO8601 timestamp representing the time the event occurred at.

  • “@version” - the version of the schema. Currently “1”

They are prefixed with an “@” symbol to avoid clashing with your own custom fields.

When serialized, this is represented in JSON. For example:

{
  "@timestamp": "2013-02-09T20:39:26.234Z",
  "@version": "1",
  message: "hello world"
}

Defined Under Namespace

Classes: DeprecatedMethod

Constant Summary collapse

CHAR_PLUS = 
"+"
TIMESTAMP = 
"@timestamp"
VERSION = 
"@version"
VERSION_ONE = 
"1"
TIMESTAMP_FAILURE_TAG = 
"_timestampparsefailure"
TIMESTAMP_FAILURE_FIELD = 
"_@timestamp"
METADATA = 
"@metadata".freeze
METADATA_BRACKETS = 
"[#{METADATA}]".freeze
MIN_FLOAT_BEFORE_SCI_NOT =

Floats outside of these upper and lower bounds are forcibly converted to scientific notation by Float#to_s

0.0001
MAX_FLOAT_BEFORE_SCI_NOT = 
1000000000000000.0
LOGGER = 
Cabin::Channel.get(LogStash)

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(data = {}) ⇒ Event

Returns a new instance of Event.



69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/logstash/event.rb', line 69

def initialize(data = {})
  @cancelled = false
  @data = data
  @accessors = LogStash::Util::Accessors.new(data)
  @data[VERSION] ||= VERSION_ONE
  ts = @data[TIMESTAMP]
  @data[TIMESTAMP] = ts ? init_timestamp(ts) : LogStash::Timestamp.now

  @metadata = @data.delete(METADATA) || {}
  @metadata_accessors = LogStash::Util::Accessors.new(@metadata)
end

Class Method Details

.validate_value(value) ⇒ Object

def to_json



261
262
263
264
265
266
267
268
269
270
271
272
273
 
# File 'lib/logstash/event.rb', line 261

def self.validate_value(value)
  case value
  when String
    raise("expected UTF-8 encoding for value=#{value}, encoding=#{value.encoding.inspect}") unless value.encoding == Encoding::UTF_8
    raise("invalid UTF-8 encoding for value=#{value}, encoding=#{value.encoding.inspect}") unless value.valid_encoding?
    value
  when Array
    value.each{|v| validate_value(v)} # don't map, return original object
    value
  else
    value
  end
end

Instance Method Details

#[](fieldref) ⇒ Object 



125
126
127
128
129
130
131
132
133
 
# File 'lib/logstash/event.rb', line 125

def [](fieldref)
  if fieldref.start_with?(METADATA_BRACKETS)
    @metadata_accessors.get(fieldref[METADATA_BRACKETS.length .. -1])
  elsif fieldref == METADATA
    @metadata
  else
    @accessors.get(fieldref)
  end
end

#[]=(fieldref, value) ⇒ Object 



136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/logstash/event.rb', line 136

def []=(fieldref, value)
  if fieldref == TIMESTAMP && !value.is_a?(LogStash::Timestamp)
    raise TypeError, "The field '@timestamp' must be a (LogStash::Timestamp, not a #{value.class} (#{value})"
  end
  if fieldref.start_with?(METADATA_BRACKETS)
    @metadata_accessors.set(fieldref[METADATA_BRACKETS.length .. -1], value)
  elsif fieldref == METADATA
    @metadata = value
    @metadata_accessors = LogStash::Util::Accessors.new(@metadata)
  else
    @accessors.set(fieldref, value)
  end
end

#append(event) ⇒ Object 



192
193
194
195
196
197
198
 
# File 'lib/logstash/event.rb', line 192

def append(event)
  # non-destructively merge that event with ourselves.

  # no need to reset @accessors here because merging will not disrupt any existing field paths
  # and if new ones are created they will be picked up.
  LogStash::Util.hash_merge(@data, event.to_hash)
end

#cancel ⇒ Object 



82
83
84
 
# File 'lib/logstash/event.rb', line 82

def cancel
  @cancelled = true
end

#cancelled? ⇒ Boolean

Returns:

  • (Boolean) 


92
93
94
 
# File 'lib/logstash/event.rb', line 92

def cancelled?
  return @cancelled
end

#clone ⇒ Object 



98
99
100
101
102
103
104
105
 
# File 'lib/logstash/event.rb', line 98

def clone
  copy = {}
  @data.each do |k,v|
    # TODO(sissel): Recurse if this is a hash/array?
    copy[k] = begin v.clone rescue v end
  end
  return self.class.new(copy)
end

#fields ⇒ Object

Raises:



151
152
153
 
# File 'lib/logstash/event.rb', line 151

def fields
  raise DeprecatedMethod
end

#include?(fieldref) ⇒ Boolean

Returns:

  • (Boolean) 


180
181
182
183
184
185
186
187
188
 
# File 'lib/logstash/event.rb', line 180

def include?(fieldref)
  if fieldref.start_with?(METADATA_BRACKETS)
    @metadata_accessors.include?(fieldref[METADATA_BRACKETS.length .. -1])
  elsif fieldref == METADATA
    true
  else
    @accessors.include?(fieldref)
  end
end

#overwrite(event) ⇒ Object 



167
168
169
170
171
172
173
174
175
176
177
 
# File 'lib/logstash/event.rb', line 167

def overwrite(event)
  # pickup new event @data and also pickup @accessors
  # otherwise it will be pointing on previous data
  @data = event.instance_variable_get(:@data)
  @accessors = event.instance_variable_get(:@accessors)

  #convert timestamp if it is a String
  if @data[TIMESTAMP].is_a?(String)
    @data[TIMESTAMP] = LogStash::Timestamp.parse_iso8601(@data[TIMESTAMP])
  end
end

#remove(fieldref) ⇒ Object 



203
204
205
 
# File 'lib/logstash/event.rb', line 203

def remove(fieldref)
  @accessors.del(fieldref)
end

#ruby_timestamp ⇒ Object

def unix_timestamp

Raises:



120
121
122
 
# File 'lib/logstash/event.rb', line 120

def ruby_timestamp
  raise DeprecatedMethod
end

#sprintf(format) ⇒ Object 



221
222
223
 
# File 'lib/logstash/event.rb', line 221

def sprintf(format)
  LogStash::StringInterpolation.evaluate(self, format)
end

#tag(value) ⇒ Object 



225
226
227
228
229
 
# File 'lib/logstash/event.rb', line 225

def tag(value)
  # Generalize this method for more usability
  self["tags"] ||= []
  self["tags"] << value unless self["tags"].include?(value)
end

#timestamp ⇒ Object

def timestamp



113
 
# File 'lib/logstash/event.rb', line 113

def timestamp; return @data[TIMESTAMP]; end

#timestamp=(val) ⇒ Object

def timestamp=



114
 
# File 'lib/logstash/event.rb', line 114

def timestamp=(val); return @data[TIMESTAMP] = val; end

#to_hash ⇒ Object 



162
163
164
 
# File 'lib/logstash/event.rb', line 162

def to_hash
  @data
end

#to_hash_with_metadata ⇒ Object 



251
252
253
 
# File 'lib/logstash/event.rb', line 251

def to_hash_with_metadata
  @metadata.empty? ? to_hash : to_hash.merge(METADATA => @metadata)
end

#to_json(*args) ⇒ Object 



156
157
158
159
 
# File 'lib/logstash/event.rb', line 156

def to_json(*args)
  # ignore arguments to respect accepted to_json method signature
  LogStash::Json.dump(@data)
end

#to_json_with_metadata(*args) ⇒ Object 



256
257
258
259
 
# File 'lib/logstash/event.rb', line 256

def to_json_with_metadata(*args)
  # ignore arguments to respect accepted to_json method signature
  LogStash::Json.dump(to_hash_with_metadata)
end

#to_s ⇒ Object 



108
109
110
 
# File 'lib/logstash/event.rb', line 108

def to_s
  self.sprintf("#{timestamp.to_iso8601} %{host} %{message}")
end

#uncancel ⇒ Object 



87
88
89
 
# File 'lib/logstash/event.rb', line 87

def uncancel
  @cancelled = false
end

#unix_timestamp ⇒ Object

Raises:



116
117
118
 
# File 'lib/logstash/event.rb', line 116

def unix_timestamp
  raise DeprecatedMethod
end