Class: LogStash::Event
- Inherits:
-
Object
- Object
- LogStash::Event
- Defined in:
- lib/logstash/event.rb
Overview
General event type. Basically a light wrapper on top of a hash.
TODO(sissel): properly handle lazy properties like parsed time formats, urls, etc, as necessary.
Constant Summary collapse
- @@date_parser =
Java::org.joda.time.format.ISODateTimeFormat.dateTimeParser.withOffsetParsed
Class Method Summary collapse
Instance Method Summary collapse
- #==(other) ⇒ Object
- #[](key) ⇒ Object
- #[]=(key, value) ⇒ Object
- #append(event) ⇒ Object
- #cancel ⇒ Object
- #cancelled? ⇒ Boolean
- #clone ⇒ Object
-
#fields ⇒ Object
def []=.
- #include?(key) ⇒ Boolean
-
#initialize(data = nil) ⇒ Event
constructor
A new instance of Event.
-
#message ⇒ Object
def message.
-
#message=(val) ⇒ Object
def message=.
- #overwrite(event) ⇒ Object
- #remove(field) ⇒ Object
-
#source ⇒ Object
def source.
- #source=(val) ⇒ Object
-
#source_host ⇒ Object
def source_host.
-
#source_host=(val) ⇒ Object
def source_host=.
-
#source_path ⇒ Object
def source_path.
-
#source_path=(val) ⇒ Object
def source_path=.
- #sprintf(format) ⇒ Object
-
#tags ⇒ Object
def tags.
-
#tags=(val) ⇒ Object
def tags=.
-
#timestamp ⇒ Object
def timestamp.
-
#timestamp=(val) ⇒ Object
def timestamp=.
-
#to_hash ⇒ Object
def to_hash.
-
#to_json(*args) ⇒ Object
def to_json.
- #to_s ⇒ Object
-
#type ⇒ Object
def type.
-
#type=(val) ⇒ Object
def type=.
- #unix_timestamp ⇒ Object
Constructor Details
#initialize(data = nil) ⇒ Event
Returns a new instance of Event.
14 15 16 17 18 19 20 21 22 23 24 |
# File 'lib/logstash/event.rb', line 14 def initialize(data=nil) @cancelled = false @data = { "@source" => "unknown", "@tags" => [], "@fields" => {}, } @data.merge!(data) unless data.nil? @data["@timestamp"] ||= LogStash::Time.now end |
Class Method Details
Instance Method Details
#==(other) ⇒ Object
275 276 277 278 279 280 281 282 |
# File 'lib/logstash/event.rb', line 275 def ==(other) #puts "#{self.class.name}#==(#{other.inspect})" if !other.is_a?(self.class) return false end return other.to_hash == self.to_hash end |
#[](key) ⇒ Object
116 117 118 119 120 121 122 123 124 |
# File 'lib/logstash/event.rb', line 116 def [](key) # If the key isn't in fields and it starts with an "@" sign, get it out of data instead of fields if ! @data["@fields"].has_key?(key) and key.slice(0,1) == "@" return @data[key] # Exists in @fields (returns value) or doesn't start with "@" (return null) else return @data["@fields"][key] end end |
#[]=(key, value) ⇒ Object
127 128 129 130 131 132 133 |
# File 'lib/logstash/event.rb', line 127 def []=(key, value) if @data.has_key?(key) @data[key] = value else @data["@fields"][key] = value end end |
#append(event) ⇒ Object
153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 |
# File 'lib/logstash/event.rb', line 153 def append(event) if event. if self. self. += "\n" + event. else self. = event. end end self. |= event. # Append all fields event.fields.each do |name, value| if self.fields.include?(name) if !self.fields[name].is_a?(Array) self.fields[name] = [self.fields[name]] end if value.is_a?(Array) self.fields[name] |= value else self.fields[name] << value unless self.fields[name].include?(value) end else self.fields[name] = value end end # event.fields.each end |
#cancel ⇒ Object
39 40 41 |
# File 'lib/logstash/event.rb', line 39 def cancel @cancelled = true end |
#cancelled? ⇒ Boolean
44 45 46 |
# File 'lib/logstash/event.rb', line 44 def cancelled? return @cancelled end |
#clone ⇒ Object
50 51 52 53 54 55 56 57 |
# File 'lib/logstash/event.rb', line 50 def clone newdata = @data.clone newdata["@fields"] = {} fields.each do |k,v| newdata["@fields"][k] = v.clone end return LogStash::Event.new(newdata) end |
#fields ⇒ Object
def []=
135 |
# File 'lib/logstash/event.rb', line 135 def fields; return @data["@fields"] end |
#include?(key) ⇒ Boolean
147 148 149 |
# File 'lib/logstash/event.rb', line 147 def include?(key) return (@data.include?(key) or @data["@fields"].include?(key)) end |
#message ⇒ Object
def message
103 |
# File 'lib/logstash/event.rb', line 103 def ; @data["@message"]; end |
#message=(val) ⇒ Object
def message=
104 |
# File 'lib/logstash/event.rb', line 104 def (val); @data["@message"] = val; end |
#overwrite(event) ⇒ Object
142 143 144 |
# File 'lib/logstash/event.rb', line 142 def overwrite(event) @data = event.to_hash end |
#remove(field) ⇒ Object
182 183 184 185 186 187 188 |
# File 'lib/logstash/event.rb', line 182 def remove(field) if @data.has_key?(field) @data.delete(field) else @data["@fields"].delete(field) end end |
#source ⇒ Object
def source
80 |
# File 'lib/logstash/event.rb', line 80 def source; @data["@source"]; end |
#source=(val) ⇒ Object
81 82 83 84 85 86 87 88 89 90 91 92 |
# File 'lib/logstash/event.rb', line 81 def source=(val) uri = URI.parse(val) rescue nil val = uri if uri if val.is_a?(URI) @data["@source"] = val.to_s @data["@source_host"] = val.host @data["@source_path"] = val.path else @data["@source"] = val @data["@source_host"] = val end end |
#source_host ⇒ Object
def source_host
95 |
# File 'lib/logstash/event.rb', line 95 def source_host; @data["@source_host"]; end |
#source_host=(val) ⇒ Object
def source_host=
96 |
# File 'lib/logstash/event.rb', line 96 def source_host=(val); @data["@source_host"] = val; end |
#source_path ⇒ Object
def source_path
99 |
# File 'lib/logstash/event.rb', line 99 def source_path; @data["@source_path"]; end |
#source_path=(val) ⇒ Object
def source_path=
100 |
# File 'lib/logstash/event.rb', line 100 def source_path=(val); @data["@source_path"] = val; end |
#sprintf(format) ⇒ Object
207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 |
# File 'lib/logstash/event.rb', line 207 def sprintf(format) if format.index("%").nil? return format end return format.gsub(/%\{[^}]+\}/) do |tok| # Take the inside of the %{ ... } key = tok[2 ... -1] if key == "+%s" # Got %{+%s}, support for unix epoch time if RUBY_ENGINE != "jruby" # This is really slow. See LOGSTASH-217 Date.parse(self.).to_i else datetime = @@date_parser.parseDateTime(self.) (datetime.getMillis / 1000).to_i end elsif key[0,1] == "+" # We got a %{+TIMEFORMAT} so use joda to format it. if RUBY_ENGINE != "jruby" # This is really slow. See LOGSTASH-217 datetime = Date.parse(self.) format = key[1 .. -1] datetime.strftime(format) else datetime = @@date_parser.parseDateTime(self.) format = key[1 .. -1] datetime.toString(format) # return requested time format end else # Use an event field. value = nil obj = self # If the top-level value exists, use that and don't try # to "look" into data structures. if self[key] value = self[key] else # "." is what ES uses to access structured data, so adopt that # idea here, too. "foo.bar" will access key "bar" under hash "foo". key.split('.').each do |segment| if obj value = obj[segment] rescue nil obj = obj[segment] rescue nil else value = nil break end end # key.split.each end # if self[key] case value when nil tok # leave the %{foo} if this field does not exist in this event. when Array value.join(",") # Join by ',' if value is an array when Hash value.to_json # Convert hashes to json else value # otherwise return the value end end end end |
#tags ⇒ Object
def tags
111 |
# File 'lib/logstash/event.rb', line 111 def ; @data["@tags"]; end |
#tags=(val) ⇒ Object
def tags=
112 |
# File 'lib/logstash/event.rb', line 112 def (val); @data["@tags"] = val; end |
#timestamp ⇒ Object
def timestamp
65 |
# File 'lib/logstash/event.rb', line 65 def ; @data["@timestamp"]; end |
#timestamp=(val) ⇒ Object
def timestamp=
66 |
# File 'lib/logstash/event.rb', line 66 def (val); @data["@timestamp"] = val; end |
#to_hash ⇒ Object
def to_hash
139 |
# File 'lib/logstash/event.rb', line 139 def to_hash; return @data end |
#to_json(*args) ⇒ Object
def to_json
138 |
# File 'lib/logstash/event.rb', line 138 def to_json(*args); return @data.to_json(*args) end |
#to_s ⇒ Object
60 61 62 |
# File 'lib/logstash/event.rb', line 60 def to_s return self.sprintf("%{@timestamp} %{@source}: %{@message}") end |
#type ⇒ Object
def type
107 |
# File 'lib/logstash/event.rb', line 107 def type; @data["@type"]; end |
#type=(val) ⇒ Object
def type=
108 |
# File 'lib/logstash/event.rb', line 108 def type=(val); @data["@type"] = val; end |
#unix_timestamp ⇒ Object
69 70 71 72 73 74 75 76 77 |
# File 'lib/logstash/event.rb', line 69 def if RUBY_ENGINE != "jruby" # This is really slow. See LOGSTASH-217 return Time.parse().to_f else time = @@date_parser.parseDateTime() return time.getMillis.to_f / 1000 end end |