Class: LogStash::Filters::Translate

Inherits:
Base show all
Defined in:
lib/logstash/filters/translate.rb

Overview

Originally written to translate HTTP response codes but turned into a general translation tool which uses configured has or/and .yaml files as a dictionary. response codes in default dictionary were scraped from ‘gem install cheat; cheat status_codes’

Alternatively for simple string search and replacements for just a few values use the gsub function of the mutate filter.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/logstash/filters/translate.rb', line 83

def filter(event)
  return unless filter?(event)

  return unless event.include?(@field) # Skip translation in case event does not have @event field.
  return if event.include?(@destination) and not @override # Skip translation in case @destination field already exists and @override is disabled.

  begin
    #If source field is array use first value and make sure source value is string
    source = event[@field].is_a?(Array) ? event[@field].first.to_s : event[@field].to_s
    matched = false
    if @exact
      if @regex
        key = @dictionary.keys.detect{|k| source.match(Regexp.new(k))}
        if key
          event[@destination] = @dictionary[key]
          matched = true
        end
      elsif @dictionary.include?(source)
        event[@destination] = @dictionary[source]
        matched = true
      end
    else 
      translation = source.gsub(Regexp.union(@dictionary.keys), @dictionary)
      if source != translation
        event[@destination] = translation
        matched = true
      end
    end

    if not matched and @fallback
      event[@destination] = @fallback
      matched = true
    end
    filter_matched(event) if matched or @field == @destination
  rescue Exception => e
    @logger.error("Something went wrong when attempting to translate from dictionary", :exception => e, :field => @field, :event => event)
  end
end

#register ⇒ Object 



64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/logstash/filters/translate.rb', line 64

def register
  if @dictionary_path
    raise "#{self.class.name}: dictionary file #{@dictionary_path} does not exists" unless File.exists?(@dictionary_path)
    begin
      @dictionary.merge!(YAML.load_file(@dictionary_path))
    rescue Exception => e
      raise "#{self.class.name}: Bad Syntax in dictionary file #{@dictionary_path}"
    end
  end
  
  @logger.debug? and @logger.debug("#{self.class.name}: Dictionary - ", :dictionary => @dictionary)
  if @exact
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Exact")
  else
    @logger.debug? and @logger.debug("#{self.class.name}: Dictionary translation method - Fuzzy")
  end
end