logstash-filter-foreach 0.1.1 → 0.1.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/logstash/filters/foreach.rb +41 -24
- data/logstash-filter-foreach.gemspec +1 -1
- data/spec/filters/foreach_spec.rb +32 -0
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 1b8b2c855be5f253874cafd451a67f956c728b8b
|
4
|
+
data.tar.gz: df60708d67752cb1541edd95b99d517e749e9718
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ec0fcfffaa57ac9ed6e7a11f2f0184957750d0f850d04097a63bfe24688ddd8135fe00af967dca878cf2f3998172406a3ece237d71d7585ab774ff041c903c49
|
7
|
+
data.tar.gz: e79445a11ab6e9f7f65eac33364aa1a6d3fb8a123c4761d98640a1cc3f9930b1de2dca32bebc0558bafd5156be426da1b4d792bc3e97aaa242fccddc05362337
|
@@ -130,26 +130,32 @@ class LogStash::Filters::Foreach < LogStash::Filters::Base
|
|
130
130
|
@@event_data[task_id] = LogStash::Filters::Foreach::Element.new(configuration, Time.now(), event.clone, configuration.join_fields)
|
131
131
|
event_data = @@event_data[task_id]
|
132
132
|
|
133
|
-
array_field.
|
133
|
+
if array_field.length == 0
|
134
134
|
|
135
|
-
|
135
|
+
passthrough = true
|
136
136
|
|
137
|
-
|
137
|
+
else
|
138
|
+
array_field.each do |value|
|
138
139
|
|
139
|
-
|
140
|
-
@logger.debug("Foreach plugin: Split event", :field => @array_field, :value => value)
|
141
|
-
event_split.set(@array_field, value)
|
142
|
-
event_data.counter += 1
|
140
|
+
@logger.trace("Foreach plugin: array_field.each do |value|", :value => value);
|
143
141
|
|
144
|
-
|
145
|
-
yield event_split
|
146
|
-
end
|
142
|
+
next if value.nil? or value.empty?
|
147
143
|
|
148
|
-
|
144
|
+
event_split = event.clone
|
145
|
+
@logger.debug("Foreach plugin: Split event", :field => @array_field, :value => value)
|
146
|
+
event_split.set(@array_field, value)
|
147
|
+
event_data.counter += 1
|
148
|
+
|
149
|
+
filter_matched(event_split)
|
150
|
+
yield event_split
|
151
|
+
end
|
152
|
+
|
153
|
+
event.cancel
|
154
|
+
end
|
149
155
|
|
150
156
|
end
|
151
157
|
|
152
|
-
else
|
158
|
+
else # if !@end
|
153
159
|
|
154
160
|
@logger.trace("Foreach plugin: else !@end");
|
155
161
|
|
@@ -168,24 +174,35 @@ class LogStash::Filters::Foreach < LogStash::Filters::Base
|
|
168
174
|
@logger.debug("Foreach plugin: Join event back", :field => configuration.array_field, :value => event.get(configuration.array_field))
|
169
175
|
|
170
176
|
event_data = @@event_data[task_id]
|
171
|
-
event_data.lastevent_timestamp = Time.now()
|
172
177
|
|
173
|
-
|
174
|
-
|
175
|
-
|
176
|
-
|
178
|
+
if event_data.sub_events_count == 0
|
179
|
+
|
180
|
+
filter_matched(event_data.initial_event)
|
181
|
+
yield event_data.initial_event
|
182
|
+
@@event_data.delete(task_id)
|
177
183
|
|
178
|
-
|
184
|
+
else
|
179
185
|
|
180
|
-
|
186
|
+
event_data.lastevent_timestamp = Time.now()
|
181
187
|
|
182
188
|
configuration.join_fields.each do |join_field|
|
183
|
-
event_data.
|
189
|
+
event_data.join_fields[join_field] += [*event.get(join_field)]
|
184
190
|
end
|
185
|
-
|
186
|
-
|
187
|
-
|
188
|
-
|
191
|
+
event_data.counter -= 1
|
192
|
+
|
193
|
+
if event_data.counter == 0
|
194
|
+
|
195
|
+
@logger.trace("Foreach plugin: if event_data.counter == 0");
|
196
|
+
|
197
|
+
configuration.join_fields.each do |join_field|
|
198
|
+
event_data.initial_event.set(join_field, event_data.join_fields[join_field])
|
199
|
+
end
|
200
|
+
filter_matched(event_data.initial_event)
|
201
|
+
yield event_data.initial_event
|
202
|
+
@@event_data.delete(task_id)
|
203
|
+
end
|
204
|
+
|
205
|
+
end # if event_data.sub_events_count == 0
|
189
206
|
|
190
207
|
event.cancel
|
191
208
|
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
s.name = 'logstash-filter-foreach'
|
3
|
-
s.version = '0.1.
|
3
|
+
s.version = '0.1.2'
|
4
4
|
s.licenses = ['Apache-2.0']
|
5
5
|
s.summary = 'Process filters for every array item'
|
6
6
|
s.description = 'Plugin splits event for every item in array, then you could process other filters for every item and then join event back'
|
@@ -215,6 +215,38 @@ describe LogStash::Filters::Foreach do
|
|
215
215
|
end
|
216
216
|
end
|
217
217
|
|
218
|
+
describe "should omit processing for event with array_field = []" do
|
219
|
+
let(:config) do
|
220
|
+
<<-CONFIG
|
221
|
+
filter {
|
222
|
+
foreach {
|
223
|
+
task_id => "%{task_id}"
|
224
|
+
array_field => "array"
|
225
|
+
join_fields => ["join"]
|
226
|
+
}
|
227
|
+
|
228
|
+
mutate {
|
229
|
+
add_field => { "join" => "%{array}_changed" }
|
230
|
+
}
|
231
|
+
|
232
|
+
foreach {
|
233
|
+
task_id => "%{task_id}"
|
234
|
+
end => true
|
235
|
+
}
|
236
|
+
}
|
237
|
+
CONFIG
|
238
|
+
end
|
239
|
+
|
240
|
+
sample("task_id" => 1, "array" => [], "unchanged" => "unchanged_value") do
|
241
|
+
insist { subject.is_a?(LogStash::Event) } == true
|
242
|
+
insist { subject.get("array").is_a?(Array) } == true
|
243
|
+
insist { subject.get("array") } == []
|
244
|
+
insist { subject.get("join").nil? } == true
|
245
|
+
insist { subject.get("unchanged").is_a?(String) } == true
|
246
|
+
insist { subject.get("unchanged") } == "unchanged_value"
|
247
|
+
end
|
248
|
+
end
|
249
|
+
|
218
250
|
describe "should split and join (partly) correctly" do
|
219
251
|
let(:config) do
|
220
252
|
<<-CONFIG
|