Reads in a file of gelf formatted events, line by line.

filegelf.rb

require 'logstash/inputs/base'
require 'logstash/namespace'

class LogStash::Inputs::FileGelf < LogStash::Inputs::Base

  config_name 'filegelf'
  milestone 2

  default :codec, 'plain'

  config :path, :validate => :array, :required => true

  config :remap, :validate => :boolean, :default => false

  config :strip_leading_underscore, :validate => :boolean, :default => false

  public
  def register
    require 'gelfd'
    @logger.info("Registering file input", :path => @path)
  end

  public
  def run(output_queue)
    puts @path
    @path.each do |path|
      File.open(path).readlines.each do |line|
        event = LogStash::Event.new(JSON.parse(line))
        if event['timestamp'].is_a?(Numeric)
          event['@timestamp'] = Time.at(event['timestamp']).gmtime
          event.remove('timestamp')
        end

        remap_gelf(event) if @remap
        strip_leading_underscore(event) if @strip_leading_underscore
        decorate(event)
        output_queue << event
      end
    end
  end

  private
  def remap_gelf(event)
    if event["full_message"]
      event["message"] = event["full_message"].dup
      event.remove("full_message")
      if event["short_message"] == event["message"]
        event.remove("short_message")
      end
    elsif event["short_message"]
      event["message"] = event["short_message"].dup
      event.remove("short_message")
    end
  end

  private
  def strip_leading_underscore(event)
     # Map all '_foo' fields to simply 'foo'
     event.to_hash.keys.each do |key|
       next unless key[0,1] == "_"
       event[key[1..-1]] = event[key]
       event.remove(key)
     end
  end
end