diff --git a/etc/agent.conf b/etc/agent.conf index acd31207a..dcae05a43 100644 --- a/etc/agent.conf +++ b/etc/agent.conf @@ -17,7 +17,7 @@ filter { add_tag => "test_tag1" add_tag => ["test_tag2", "test_tag3"] add_field => ["grok_filtered", "true"] - add_field => ["test_key", "test_value"] + add_field => ["test_key", "the pid is %{pid}"] } } diff --git a/lib/logstash/config/mixin.rb b/lib/logstash/config/mixin.rb index 07ba0c6c4..3602533cd 100644 --- a/lib/logstash/config/mixin.rb +++ b/lib/logstash/config/mixin.rb @@ -178,7 +178,14 @@ module LogStash::Config::Mixin result = value.first elsif validator.is_a?(Symbol) # TODO(sissel): Factor this out into a coersion method? + # TODO(sissel): Document this stuff. case validator + when :hash + if value.size % 2 == 1 + return false, "This field must contain an even number of items, got #{value.size}" + end + # Use Hash[] (works in 1.8.7, anyway) to coerce into a hash. + result = Hash[*value] when :string if value.size > 1 # only one value wanted return false, "Expected string, got #{value.inspect}" diff --git a/lib/logstash/filters/base.rb b/lib/logstash/filters/base.rb index 11d04e87d..0572a0460 100644 --- a/lib/logstash/filters/base.rb +++ b/lib/logstash/filters/base.rb @@ -10,7 +10,7 @@ class LogStash::Filters::Base config_name "filter" config :type => :string config :add_tag => nil - config :add_field => nil + config :add_field => :hash public def initialize(params) @@ -45,16 +45,11 @@ class LogStash::Filters::Base @add_tag.each { |tag| event.tags << tag } end if @add_field - if @add_field.length % 2 != 0 - @logger.warn("filter #{self.class}: add_field must be an even amount of fields [key1, val1, key2, val2, ...]") - else - combos = @add_field.length / 2 - 0.upto(combos - 1) do |i| - field, value = @add_field[2*i], @add_field[2*i+1] - event[field] ||= [] - event[field] << value - end # 0.upto(combos) - end # if @add_field.length % 2 + @add_field.each do |field, value| + @logger.info "Adding field: #{field} => #{event.sprintf(value)}" + event[field] ||= [] + event[field] << event.sprintf(value) + end # @add_field.each end # if @add_field end # def filter_matched end # class LogStash::Filters::Base diff --git a/lib/logstash/filters/grok.rb b/lib/logstash/filters/grok.rb index b3a2a052b..5ac53d1ba 100644 --- a/lib/logstash/filters/grok.rb +++ b/lib/logstash/filters/grok.rb @@ -51,7 +51,6 @@ class LogStash::Filters::Grok < LogStash::Filters::Base end if match - filter_matched(event) match.each_capture do |key, value| if key.include?(":") key = key.split(":")[1] @@ -72,6 +71,7 @@ class LogStash::Filters::Grok < LogStash::Filters::Base event.fields[key] << value end end + filter_matched(event) else # Tag this event if we can't parse it. We can use this later to # reparse+reindex logs if we improve the patterns given .