Class: LogStash::Filters::Ruby

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/ruby.rb

Overview

Execute ruby code.

For example, to cancel 90% of events, you can do this:

source,ruby

filter {

ruby {
  # Cancel 90% of events
  code => "event.cancel if rand <= 0.90"
}

}

If you need to create additional events, it cannot be done as in other filters where you would use ‘yield`, you must use a specific syntax `new_event_block.call(event)` like in this example duplicating the input event

source,ruby

filter {

ruby {
  code => "new_event_block.call(event.clone)"
}

}

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(*params) ⇒ Ruby

Returns a new instance of Ruby.



47
48
49
50
51
52
53
54
 
# File 'lib/logstash/filters/ruby.rb', line 47

def initialize(*params)
  super(*params)
  if @path # run tests on the ruby file script
    @script = Script.new(@path, @script_params)
    @script.load
    @script.test
  end
end

Class Method Details

.check_result_events!(results) ⇒ Object 



67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/logstash/filters/ruby.rb', line 67

def self.check_result_events!(results)
  if !results.is_a?(Array)
    raise "Custom script did not return an array from 'filter'. Only arrays may be returned!"
  end

  results.each do |r_event|
    if !r_event.is_a?(::LogStash::Event)
      raise "Custom script returned a non event object '#{r_event.inspect}'!" +
            " You must an array of events from this function! To drop an event simply return nil."
    end
  end
end

Instance Method Details

#file_script(event) ⇒ Object 



96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/logstash/filters/ruby.rb', line 96

def file_script(event)
  begin
    results = @script.execute(event)
    filter_matched(event)

    self.class.check_result_events!(results)
  rescue => e
    event.tag(@tag_on_exception)
    message = "Could not process event: " + e.message
    @logger.error(message, :script_path => @path,
                           :class => e.class.name,
                           :backtrace => e.backtrace)
    return event
  end

  returned_original = false
  results.each do |r_event|
    # If the user has generated a new event we yield that for them here
    if event == r_event
      returned_original = true
    else
      yield r_event
    end

    r_event
  end

  event.cancel unless returned_original
end

#filter(event, &block) ⇒ Object 



80
81
82
83
84
85
86
 
# File 'lib/logstash/filters/ruby.rb', line 80

def filter(event, &block)
  if @code
    inline_script(event, &block)
  elsif @path
    file_script(event, &block)
  end
end

#inline_script(event, &block) ⇒ Object 



88
89
90
91
92
93
94
 
# File 'lib/logstash/filters/ruby.rb', line 88

def inline_script(event, &block)
  filter_method(event, &block)
  filter_matched(event)
rescue Exception => e
  @logger.error("Ruby exception occurred: #{e}")
  event.tag(@tag_on_exception)
end

#register ⇒ Object 



56
57
58
59
60
61
62
63
64
65
 
# File 'lib/logstash/filters/ruby.rb', line 56

def register
  if @code && @path.nil?
    eval(@init, binding, "(ruby filter init)") if @init
    eval("define_singleton_method :filter_method do |event, &new_event_block|\n #{@code} \nend", binding, "(ruby filter code)")
  elsif @path && @code.nil?
    @script.register
  else
    @logger.fatal("You must either use an inline script with the \"code\" option or a script file using \"path\".")
  end
end