Class: LogStash::Filters::CSV
- Defined in:
- lib/logstash/filters/csv.rb
Overview
CSV filter. Takes an event field containing CSV data, parses it, and stores it as individual fields (can optionally specify the names).
Constant Summary
Constants inherited from Base
Constants included from Config::Mixin
Instance Attribute Summary
Attributes included from Config::Mixin
Attributes inherited from Plugin
Instance Method Summary collapse
Methods inherited from Base
#execute, #initialize, #threadsafe?
Methods included from Config::Mixin
Methods inherited from Plugin
#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s
Constructor Details
This class inherits a constructor from LogStash::Filters::Base
Instance Method Details
#filter(event) ⇒ Object
45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 |
# File 'lib/logstash/filters/csv.rb', line 45 def filter(event) return unless filter?(event) @logger.debug("Running csv filter", :event => event) matches = 0 if event[@source] if event[@source].is_a?(String) event[@source] = [event[@source]] end if event[@source].length > 1 @logger.warn("csv filter only works on fields of length 1", :source => @source, :value => event[@source], :event => event) return end raw = event[@source].first begin values = CSV.parse_line(raw, :col_sep => @separator, :quote_char => @quote_char) if @target.nil? # Default is to write to the root of the event. dest = event else dest = event[@target] ||= {} end values.each_index do |i| field_name = @columns[i] || "column#{i+1}" dest[field_name] = values[i] end filter_matched(event) rescue => e event.tag "_csvparsefailure" @logger.warn("Trouble parsing csv", :source => @source, :raw => raw, :exception => e) return end # begin end # if event @logger.debug("Event after csv filter", :event => event) end |
#register ⇒ Object
38 39 40 41 42 |
# File 'lib/logstash/filters/csv.rb', line 38 def register # Nothing to do here end |