Class: LogStash::Filters::Json

Inherits:
Base show all
Defined in:
lib/logstash/filters/json.rb

Overview

JSON filter. Takes a field that contains JSON and expands it into an actual datastructure.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/logstash/filters/json.rb', line 50

def filter(event)
  return unless filter?(event)

  @logger.debug("Running json filter", :event => event)

  return unless event.include?(@source)

  if @target.nil?
    # Default is to write to the root of the event.
    dest = event.to_hash
  else
    dest = event[@target] ||= {}
  end

  begin
    # TODO(sissel): Note, this will not successfully handle json lists
    # like your text is '[ 1,2,3 ]' JSON.parse gives you an array (correctly)
    # which won't merge into a hash. If someone needs this, we can fix it
    # later.
    dest.merge!(JSON.parse(event[@source]))

    # This is a hack to help folks who are mucking with @timestamp during
    # their json filter. You aren't supposed to do anything with "@timestamp"
    # outside of the date filter, but nobody listens... ;)
    if event["@timestamp"].is_a?(String)
      event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime
    end

    filter_matched(event)
  rescue => e
    event.tag("_jsonparsefailure")
    @logger.warn("Trouble parsing json", :source => @source,
                 :raw => event[@source], :exception => e)
    return
  end

  @logger.debug("Event after json filter", :event => event)

end

#register ⇒ Object 



45
46
47
 
# File 'lib/logstash/filters/json.rb', line 45

def register
  # Nothing to do here
end