Skip to content

Commit

Permalink
Merge remote-tracking branch 'conceptboard/mutate-gsub'
Browse files Browse the repository at this point in the history
  • Loading branch information
fetep committed Jul 7, 2012
2 parents b7179e7 + 7175bad commit 16a351a
Showing 1 changed file with 61 additions and 0 deletions.
61 changes: 61 additions & 0 deletions lib/logstash/filters/mutate.rb
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,26 @@ class LogStash::Filters::Mutate < LogStash::Filters::Base
# }
config :convert, :validate => :hash

# Convert a string field by applying a regular expression and a replacement
# if the field is not a string, no action will be taken
#
# this configuration takes an array consisting of 3 elements per field/substitution
#
# be aware of escaping any backslash in the config file
#
# for example:
#
# mutate {
# …
# gsub => [
# "fieldname", "\\/", "_", #replace all forward slashes with underscore
# "fieldname", "[\\?#-]", "_" #replace backslashes, question marks, hashes and minuses with underscore
# ]
# …
# }
#
config :gsub, :validate => :array

public
def register
valid_conversions = %w(string integer float)
Expand All @@ -73,6 +93,19 @@ def register
raise "Bad configuration, aborting."
end
end # @convert.each

@gsub_parsed = []
@gsub.nil? or @gsub.each_slice(3) do |field, needle, replacement|
if [field, needle, replacement].any? {|n| n.nil?}
@logger.error("Invalid gsub configuration. gsub has to define 3 elements per config entry", :file => file, :needle => needle, :replacement => replacement)
raise "Bad configuration, aborting."
end
@gsub_parsed << {
:field => field,
:needle => Regexp.new(needle),
:replacement => replacement
}
end
end # def register

public
Expand All @@ -83,6 +116,7 @@ def filter(event)
remove(event) if @remove
replace(event) if @replace
convert(event) if @convert
gsub(event) if @gsub

filter_matched(event)
end # def filter
Expand Down Expand Up @@ -143,4 +177,31 @@ def convert_integer(value)
def convert_float(value)
return value.to_f
end # def convert_float

private
def gsub(event)
@gsub_parsed.each do |config|
field = config[:field]
needle = config[:needle]
replacement = config[:replacement]

if(event[field].is_a? Array)
event[field] = event[field].map do |v|
if not v.is_a? String
@logger.debug("gsub mutation is only applicable for Strings, skipping",
:field => field, :value => event[field])
next
end
v.gsub(needle, replacement)
end
else
if not event[field].is_a? String
@logger.debug("gsub mutation is only applicable for Strings, skipping",
:field => field, :value => event[field])
next
end
event[field] = event[field].gsub(needle, replacement)
end
end # @gsub_parsed.each
end # def gsub
end # class LogStash::Filters::Mutate

0 comments on commit 16a351a

Please sign in to comment.