Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions docs/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,15 @@ fingerprint computation. If `false` and at least one source field is
given, the target field will be an array with fingerprints of the
source fields given.

[id="plugins-{type}s-{plugin}-exclude"]
===== `exclude`

* Value type is <<array,array>>
* Default value is ``

The name(s) of field(s) to exclude when `concatenate_all_fields` is set to
`true`.

[id="plugins-{type}s-{plugin}-key"]
===== `key`

Expand Down
32 changes: 26 additions & 6 deletions lib/logstash/filters/fingerprint.rb
Original file line number Diff line number Diff line change
Expand Up @@ -71,11 +71,15 @@ class LogStash::Filters::Fingerprint < LogStash::Filters::Base
# of the source fields given.
config :concatenate_sources, :validate => :boolean, :default => false

# When set to `true` and `method` isn't `UUID` or `PUNCTUATION`, the
# plugin concatenates the names and values of all fields in the event
# When set to `true` and `method` isn't `UUID` or `PUNCTUATION`, the
# plugin concatenates the names and values of all fields in the event
# without having to proide the field names in the `source` attribute
config :concatenate_all_fields, :validate => :boolean, :default => false

# The name(s) of field(s) to exclude when `concatenate_all_fields` is set to
# true.
config :exclude, :validate => :array, :default => ''

def register
# convert to symbol for faster comparisons
@method = @method.to_sym
Expand Down Expand Up @@ -104,6 +108,24 @@ class << self; alias_method :fingerprint, :fingerprint_openssl; end
end
end

def serialize(event, depth=0)
to_string = ""
if event.respond_to?(:to_hash)
depth += 1
to_string << "{"
event.to_hash.sort.map do |k,v|
if not (depth == 1 and @exclude.include?(k))
to_string << "#{k}:#{serialize(v, depth)},"
end
end
to_string << "}"
else
to_string << "#{event}"
end

return to_string
end

def filter(event)
case @method
when :UUID
Expand All @@ -120,12 +142,10 @@ def filter(event)
if @concatenate_sources || @concatenate_all_fields
to_string = ""
if @concatenate_all_fields
event.to_hash.sort.map do |k,v|
to_string << "|#{k}|#{v}"
end
to_string << serialize(event)
else
@source.sort.each do |k|
to_string << "|#{k}|#{event.get(k)}"
to_string << "|#{k}|#{serialize(event.get(k))}"
end
end
to_string << "|"
Expand Down