Class: LogStash::Filters::Xml

Inherits:
Base show all
Defined in:
lib/logstash/filters/xml.rb

Overview

XML filter. Takes a field that contains XML and expands it into an actual datastructure.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'lib/logstash/filters/xml.rb', line 73

def filter(event)
  return unless filter?(event)
  matched = false

  @logger.debug("Running xml filter", :event => event)

  return unless event.include?(@source)

  value = event[@source]

  if value.is_a?(Array) && value.length > 1
    @logger.warn("XML filter only works on fields of length 1",
                 :source => @source, :value => value)
    return
  end

  # Do nothing with an empty string.
  return if value.strip.length == 0

  if @xpath
    begin
      doc = Nokogiri::XML(value)
    rescue => e
      event.tag("_xmlparsefailure")
      @logger.warn("Trouble parsing xml", :source => @source, :value => value,
                   :exception => e, :backtrace => e.backtrace)
      return
    end

    @xpath.each do |xpath_src, xpath_dest|
      nodeset = doc.xpath(xpath_src)

      # If asking xpath for a String, like "name(/*)", we get back a
      # String instead of a NodeSet.  We normalize that here.
      normalized_nodeset = nodeset.kind_of?(Nokogiri::XML::NodeSet) ? nodeset : [nodeset]

      normalized_nodeset.each do |value|
        # some XPath functions return empty arrays as string
        if value.is_a?(Array)
          return if value.length == 0
        end

        unless value.nil?
          matched = true
          event[xpath_dest] ||= []
          event[xpath_dest] << value.to_s
        end
      end # XPath.each
    end # @xpath.each
  end # if @xpath

  if @store_xml
    begin
      event[@target] = XmlSimple.xml_in(value)
      matched = true
    rescue => e
      event.tag("_xmlparsefailure")
      @logger.warn("Trouble parsing xml with XmlSimple", :source => @source,
                   :value => value, :exception => e, :backtrace => e.backtrace)
      return
    end
  end # if @store_xml

  filter_matched(event) if matched
  @logger.debug("Event after xml filter", :event => event)
end

#register ⇒ Object 



66
67
68
69
70
 
# File 'lib/logstash/filters/xml.rb', line 66

def register
  require "nokogiri"
  require "xmlsimple"

end