Class: LogStash::Filters::Grep

Inherits:
Base show all
Defined in:
lib/logstash/filters/grep.rb

Overview

Grep filter. Useful for dropping events you don’t want to pass, or adding tags or fields to events that match.

Events not matched are dropped. If ‘negate’ is set to true (defaults false), then matching events are dropped.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
 
# File 'lib/logstash/filters/grep.rb', line 70

def filter(event)
  return unless filter?(event)

  @logger.debug("Running grep filter", :event => event, :config => config)
  matches = 0

  # If negate is set but no patterns are given, drop the event.
  # This is useful in cases where you want to drop all events with
  # a given type or set of tags
  #
  # filter {
  #   grep {
  #     negate => true
  #     type => blah
  #   }
  # }
  if @negate && @patterns.empty?
    event.cancel
    return
  end

  @patterns.each do |field, regexes|
    # For each match object, we have to match everything in order to
    # apply any fields/tags.
    match_count = 0
    match_want = 0
    regexes.each do |re|
      match_want += 1

      # Events without this field, with negate enabled, count as a match.
      # With negate disabled, we can't possibly match, so skip ahead.
      if event[field].nil?
        if @negate
          msg = "Field not present, but negate is true; marking as a match"
          @logger.debug(msg, :field => field, :event => event)
          match_count += 1
        else
          @logger.debug("Skipping match object, field not present",
                        :field => field, :event => event)
        end
        # Either way, don't try to process -- may end up with extra unwanted
        # +1's to match_count
        next
      end

      (event[field].is_a?(Array) ? event[field] : [event[field]]).each do |value|
        value = value.to_s if value.is_a?(Numeric)
        if @negate
          @logger.debug("negate match", :regexp => re, :value => value)
          next if re.match(value)
          @logger.debug("grep not-matched (negate requested)", field => value)
        else
          @logger.debug("want match", :regexp => re, :value => value)
          next unless re.match(value)
          @logger.debug("grep matched", field => value)
        end
        match_count += 1
        break
      end # each value in event[field]
    end # regexes.each

    if match_count == match_want
      matches += 1
      @logger.debug("matched all fields", :count => match_count)
    else
      @logger.debug("match failed", :count => match_count, :wanted => match_want)
    end # match["match"].each
  end # @patterns.each

  if matches == @patterns.length
    filter_matched(event)
  else
    if @drop == true
      @logger.debug("grep: dropping event, no matches")
      event.cancel
    else
      @logger.debug("grep: no matches, but drop set to false")
    end
    return
  end

  @logger.debug("Event after grep filter", :event => event)
end

#register ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/logstash/filters/grep.rb', line 51

def register
  @logger.warn("The 'grep' plugin is no longer necessary now that you can do if/elsif/else in logstash configs. This plugin will be removed in the future. If you need to drop events, please use the drop filter. If you need to take action based on a match, use an 'if' block and the mutate filter. See the following URL for details on how to use if/elsif/else in your logstash configs:http://logstash.net/docs/#{LOGSTASH_VERSION}/configuration")

  @patterns = Hash.new { |h,k| h[k] = [] }

    # TODO(sissel): 
  @match.each do |field, pattern|

    pattern = [pattern] if pattern.is_a?(String)
    pattern.each do |p|
      re = Regexp.new(p, @ignore_case ? Regexp::IGNORECASE : 0)
      @patterns[field] << re
      @logger.debug? and @logger.debug("Registered grep", :type => @type, :field => field,
                  :pattern => p, :regexp => re)
    end
  end # @match.merge.each
end