Class: LogStash::Inputs::Beats::DecodedEventTransform
- Inherits:
-
EventTransformCommon
- Object
- EventTransformCommon
- LogStash::Inputs::Beats::DecodedEventTransform
- Defined in:
- lib/logstash/inputs/beats/decoded_event_transform.rb
Overview
Take the extracted content from the codec, merged with the other data coming from beats, apply the configured tags, normalize the host and try to coerce the timestamp if it was provided in the hash.
Instance Method Summary collapse
Methods inherited from EventTransformCommon
#codec_name, #copy_beat_hostname, #decorate, #include_codec_tag?, #initialize
Constructor Details
This class inherits a constructor from LogStash::Inputs::Beats::EventTransformCommon
Instance Method Details
#transform(event, hash) ⇒ Object
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
# File 'lib/logstash/inputs/beats/decoded_event_transform.rb', line 8 def transform(event, hash) ts = coerce_ts(hash.delete("@timestamp")) event.set("@timestamp", ts) unless ts.nil? hash.each do |k, v| #could be a nested map, so we need to merge and not overwrite existing_value = event.get(k) if existing_value.is_a?(Hash) existing_value = existing_value.merge(v) else existing_value = v end event.set(k, existing_value) end super(event) event.tag("beats_input_codec_#{codec_name}_applied") if include_codec_tag? event end |