Class: LogStash::Filters::Emoji

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/emoji.rb

Overview

This plugin maps the severity names or numeric codes as defined in tools.ietf.org/html/rfc3164#section-4.1.1[RFC 3164] and tools.ietf.org/html/rfc5424#section-6.2.1[RFC 5424] to the emoji as defined in the configuration.

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/logstash/filters/emoji.rb', line 85

def filter(event)
  return unless event.include?(@field) # Skip if event does not have specified field.
  return if event.include?(@target) and not @override # Skip if @target field already exists and @override is false.

  begin
    #If source field is array use first value and make sure source value is string
    source = event.get(@field).is_a?(Array) ? event.get(@field).first.to_s : event.get(@field).to_s
    matched = false
    key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))}
    if key
      event.set(@target, @dictionary[key] )
      metric.increment(:matches)
      matched = true
    end

    if not matched and @fallback
      event.set(@target, event.sprintf(@fallback))
      metric.increment(:matches)
      matched = true
    end
    filter_matched(event) if matched or @field == @target
  rescue Exception => e
    metric.increment(:failures)
    @logger.error("Something went wrong when attempting to match from dictionary", :exception => e, :field => @field, :event => event)
  end
end

#register ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/logstash/filters/emoji.rb', line 65

def register
  @dictionary = {
     "^0$|Emergency|EMERGENCY|emerg|EMERG" => @sev_emergency,
     "^1$|Alert|ALERT|alert" => @sev_alert,
     "^2$|Critical|CRITICAL|crit|CRIT" => @sev_critical,
     "^3$|Error|ERROR|err|ERR" => @sev_error,
     "^4$|Warning|WARNING|warn|WARN" => @sev_warning,
     "^5$|Notice|NOTICE|notice" => @sev_notice,
     "^6$|Informational|INFORMATIONAL|info|INFO" => @sev_info,
     "^7$|Debug|DEBUG|debug" => @sev_debug
  }
  @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
  if @exact
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Exact")
  else
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary matching method - Fuzzy")
  end
end