- Pad time fraction so it's sortable.

- Use strings, not symbols since symbols aren't valid in json (and become
  strings anyway)

lib/logstash/event.rb

@@ -6,8 +6,8 @@ module LogStash; class Event
   def initialize(data)
     @cancelled = false
     @data = data
-    if !@data.include?(:received_timestamp)
-      @data[:received_timestamp] = LogStash::Time.now.utc.to_iso8601
+    if !@data.include?("received_timestamp")
+      @data["received_timestamp"] = LogStash::Time.now.utc.to_iso8601
     end
   end # def initialize
 
@@ -46,7 +46,7 @@ module LogStash; class Event
   end # def []=
 
   def timestamp
-    @data[:received_timestamp] or @data["received_timestamp"]
+    @data["received_timestamp"]
   end # def timestamp
 
   def source

lib/logstash/filters/grok.rb

@@ -39,12 +39,16 @@ class LogStash::Filters::Grok
       #pattern = @grok.discover(message)
       #@grok.compile(pattern)
       #match = @grok.match(message)
+      puts "No known tag for #{event.source} / #{event["tags"]}"
+      puts event.to_hash.inspect
     end
 
     if match
       match.each_capture do |key, value|
         if key.include?(":")
           key = key.split(":")[1]
+        else
+          next
         end
 
         if event[key].is_a?(String)

lib/logstash/inputs/file.rb

@@ -34,9 +34,9 @@ class LogStash::Inputs::File
   public
   def receive(event)
     event = LogStash::Event.new({
-      :source => @url.to_s,
-      :message => event,
-      :tags => @tags,
+      "source" => @url.to_s,
+      "message" => event,
+      "tags" => @tags,
     })
     @callback.call(event)
   end # def event

lib/logstash/outputs/elasticsearch.rb

@@ -15,12 +15,14 @@ class LogStash::Outputs::Elasticsearch
     # Authentication?
     @httpurl = @url.clone
     @httpurl.scheme = "http"
+    @http = EventMachine::HttpRequest.new(@httpurl.to_s)
   end # def register
 
   def receive(event)
-    http = EventMachine::HttpRequest.new(@httpurl.to_s).post :body => event.to_json
-    http.errback do
-      $stderr.puts "Request to index to #{url.to_s} failed. Event was #{event.to_s}"
+    #http = EventMachine::HttpRequest.new(@httpurl.to_s).post :body => event.to_json
+    req = @http.post :body => event.to_json
+    req.errback do
+      $stderr.puts "Request to index to #{@httpurl.to_s} failed. Event was #{event.to_s}"
     end
   end # def event
 end # class LogStash::Outputs::Websocket

lib/logstash/time.rb

@@ -14,6 +14,7 @@ module LogStash; class Time < ::Time
     else
       tz = self.strftime("%z")
     end
-    return self.strftime("%Y-%m-%d %H:%M:%S") + ".#{self.tv_usec}#{tz}"
+    # zero-pad tv_usec so the time string is sortable.
+    return "%s.%06d%s" % [self.strftime("%Y-%m-%dT%H:%M:%S"), self.tv_usec, tz]
   end
 end; end # class LogStash::Time