From 3762d20949aa1dde1a990a9b00e5e87833831b9e Mon Sep 17 00:00:00 2001 From: Eric Fontana Date: Mon, 29 Sep 2014 11:04:55 -0400 Subject: [PATCH] Added promote option --- .../Properties/AssemblyInfo.cs | 4 +- TimberWinR/Filters/JsonFilter.cs | 302 +++++++++--------- TimberWinR/Parser.cs | 6 +- TimberWinR/mdocs/JsonFilter.md | 1 + 4 files changed, 165 insertions(+), 148 deletions(-) diff --git a/TimberWinR.ServiceHost/Properties/AssemblyInfo.cs b/TimberWinR.ServiceHost/Properties/AssemblyInfo.cs index 83cf33a..043414a 100644 --- a/TimberWinR.ServiceHost/Properties/AssemblyInfo.cs +++ b/TimberWinR.ServiceHost/Properties/AssemblyInfo.cs @@ -32,5 +32,5 @@ using System.Runtime.InteropServices; // You can specify all the values or you can default the Build and Revision Numbers // by using the '*' as shown below: // [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.3.1.0")] -[assembly: AssemblyFileVersion("1.3.1.0")] +[assembly: AssemblyVersion("1.3.2.0")] +[assembly: AssemblyFileVersion("1.3.2.0")] diff --git a/TimberWinR/Filters/JsonFilter.cs b/TimberWinR/Filters/JsonFilter.cs index ca052fc..11f9831 100644 --- a/TimberWinR/Filters/JsonFilter.cs +++ b/TimberWinR/Filters/JsonFilter.cs @@ -9,163 +9,175 @@ using Newtonsoft.Json.Linq; using NLog; namespace TimberWinR.Parser -{ - public partial class Json : LogstashFilter - { - public Json() - { - RemoveSource = true; - } - public override JObject ToJson() - { - JObject json = new JObject( - new JProperty("json", - new JObject( - new JProperty("condition", Condition), - new JProperty("source", Source), - new JProperty("target", Target), - new JProperty("addfields", AddField), - new JProperty("addtags", AddTag), - new JProperty("removefields", RemoveField), - new JProperty("removetag", RemoveTag) - ))); - return json; - } +{ + public partial class Json : LogstashFilter + { + public Json() + { + RemoveSource = true; + } + public override JObject ToJson() + { + JObject json = new JObject( + new JProperty("json", + new JObject( + new JProperty("condition", Condition), + new JProperty("source", Source), + new JProperty("promote", Source), + new JProperty("target", Target), + new JProperty("addfields", AddField), + new JProperty("addtags", AddTag), + new JProperty("removefields", RemoveField), + new JProperty("removetag", RemoveTag) + ))); + return json; + } - public override bool Apply(JObject json) - { - if (!string.IsNullOrEmpty(Type)) - { - JToken json_type = json["type"]; - if (json_type != null && json_type.ToString() != Type) - return true; // Filter does not apply. - } + public override bool Apply(JObject json) + { + if (!string.IsNullOrEmpty(Type)) + { + JToken json_type = json["type"]; + if (json_type != null && json_type.ToString() != Type) + return true; // Filter does not apply. + } - if (Condition != null) - { - var expr = EvaluateCondition(json, Condition); - if (!expr) + if (Condition != null) + { + var expr = EvaluateCondition(json, Condition); + if (!expr) return true; - } + } - var source = json[Source]; - if (source == null) - return true; + var source = json[Source]; + if (source == null) + return true; - var jsonOrig = source.ToString(); + var jsonOrig = source.ToString(); - if (!string.IsNullOrEmpty(source.ToString())) - { - try - { - JObject subJson; + if (!string.IsNullOrEmpty(source.ToString())) + { + try + { + JObject subJson; - if (Target != null && !string.IsNullOrEmpty(Target)) - { - subJson = new JObject(); - subJson[Target] = JObject.Parse(source.ToString()); - } - else - subJson = JObject.Parse(source.ToString()); - - json.Merge(subJson, new JsonMergeSettings - { - MergeArrayHandling = MergeArrayHandling.Replace - }); + if (Target != null && !string.IsNullOrEmpty(Target)) + { + subJson = new JObject(); + subJson[Target] = JObject.Parse(source.ToString()); + } + else + subJson = JObject.Parse(source.ToString()); - if (Rename != null && Rename.Length > 0) - { - string oldName = ExpandField(Rename[0], json); - string newName = ExpandField(Rename[1], json); - RenameProperty(json, oldName, newName); - } - - if (RemoveSource) - { - RemoveProperties(json, new string[] { Source }); - } - - } - catch (Exception ex) - { - LogManager.GetCurrentClassLogger().Error(ex); - return true; - } - } - - AddFields(json); - AddTags(json); - RemoveFields(json); - RemoveTags(json); - - return true; - } + if (!string.IsNullOrEmpty(Promote)) + { + var promotedJson = subJson[Promote]; + RemoveProperties(subJson, new string[] { Promote }); - private void AddFields(Newtonsoft.Json.Linq.JObject json) - { - if (AddField != null && AddField.Length > 0) - { - for (int i = 0; i < AddField.Length; i += 2) - { - string fieldName = ExpandField(AddField[i], json); - string fieldValue = ExpandField(AddField[i + 1], json); - AddOrModify(json, fieldName, fieldValue); - } - } - } + subJson.Merge(promotedJson, new JsonMergeSettings + { + MergeArrayHandling = MergeArrayHandling.Replace + }); + } - private void RemoveFields(Newtonsoft.Json.Linq.JObject json) - { - if (RemoveField != null && RemoveField.Length > 0) - { - for (int i = 0; i < RemoveField.Length; i++) - { - string fieldName = ExpandField(RemoveField[i], json); - RemoveProperties(json, new string[] { fieldName }); - } - } - } + json.Merge(subJson, new JsonMergeSettings + { + MergeArrayHandling = MergeArrayHandling.Replace + }); - private void AddTags(Newtonsoft.Json.Linq.JObject json) - { - if (AddTag != null && AddTag.Length > 0) - { - for (int i = 0; i < AddTag.Length; i++) - { - string value = ExpandField(AddTag[i], json); + if (Rename != null && Rename.Length > 0) + { + string oldName = ExpandField(Rename[0], json); + string newName = ExpandField(Rename[1], json); + RenameProperty(json, oldName, newName); + } - JToken tags = json["tags"]; - if (tags == null) - json.Add("tags", new JArray(value)); - else - { - JArray a = tags as JArray; - a.Add(value); - } - } - } - } + if (RemoveSource) + { + RemoveProperties(json, new string[] { Source }); + } - private void RemoveTags(Newtonsoft.Json.Linq.JObject json) - { - if (RemoveTag != null && RemoveTag.Length > 0) - { - JToken tags = json["tags"]; - if (tags != null) - { - List children = tags.Children().ToList(); - for (int i = 0; i < RemoveTag.Length; i++) - { - string tagName = ExpandField(RemoveTag[i], json); - foreach (JToken token in children) - { - if (token.ToString() == tagName) - token.Remove(); - } - } - } - } - } + } + catch (Exception ex) + { + LogManager.GetCurrentClassLogger().Error(ex); + return true; + } + } - } + AddFields(json); + AddTags(json); + RemoveFields(json); + RemoveTags(json); + + return true; + } + + private void AddFields(Newtonsoft.Json.Linq.JObject json) + { + if (AddField != null && AddField.Length > 0) + { + for (int i = 0; i < AddField.Length; i += 2) + { + string fieldName = ExpandField(AddField[i], json); + string fieldValue = ExpandField(AddField[i + 1], json); + AddOrModify(json, fieldName, fieldValue); + } + } + } + + private void RemoveFields(Newtonsoft.Json.Linq.JObject json) + { + if (RemoveField != null && RemoveField.Length > 0) + { + for (int i = 0; i < RemoveField.Length; i++) + { + string fieldName = ExpandField(RemoveField[i], json); + RemoveProperties(json, new string[] { fieldName }); + } + } + } + + private void AddTags(Newtonsoft.Json.Linq.JObject json) + { + if (AddTag != null && AddTag.Length > 0) + { + for (int i = 0; i < AddTag.Length; i++) + { + string value = ExpandField(AddTag[i], json); + + JToken tags = json["tags"]; + if (tags == null) + json.Add("tags", new JArray(value)); + else + { + JArray a = tags as JArray; + a.Add(value); + } + } + } + } + + private void RemoveTags(Newtonsoft.Json.Linq.JObject json) + { + if (RemoveTag != null && RemoveTag.Length > 0) + { + JToken tags = json["tags"]; + if (tags != null) + { + List children = tags.Children().ToList(); + for (int i = 0; i < RemoveTag.Length; i++) + { + string tagName = ExpandField(RemoveTag[i], json); + foreach (JToken token in children) + { + if (token.ToString() == tagName) + token.Remove(); + } + } + } + } + } + + } } diff --git a/TimberWinR/Parser.cs b/TimberWinR/Parser.cs index 2ce4239..786b7c2 100644 --- a/TimberWinR/Parser.cs +++ b/TimberWinR/Parser.cs @@ -704,7 +704,7 @@ namespace TimberWinR.Parser [JsonProperty("remove_tag")] public string[] RemoveTag { get; set; } - + public override void Validate() { if (string.IsNullOrEmpty(Source)) @@ -764,6 +764,10 @@ namespace TimberWinR.Parser [JsonProperty("rename")] public string[] Rename { get; set; } + [JsonProperty("promote")] + public string Promote { get; set; } + + public override void Validate() { if (string.IsNullOrEmpty(Source)) diff --git a/TimberWinR/mdocs/JsonFilter.md b/TimberWinR/mdocs/JsonFilter.md index a582046..1e45ec0 100644 --- a/TimberWinR/mdocs/JsonFilter.md +++ b/TimberWinR/mdocs/JsonFilter.md @@ -11,6 +11,7 @@ The following operations are allowed when mutating a field. | *condition* | property:string |C# expression, if the expression is true, continue, otherwise, ignore | *remove_source* | property:bool |If true, the source property is removed, default: true | *source* | property:string |Required field indicates which field contains the Json to be parsed +| *promote* | property:string |If supplied any properties named *promote* will be promoted to top-level | *target* | property:string |If suppled, the parsed json will be contained underneath a propery named *target* | *add_field* | property:array |If the filter is successful, add an arbitrary field to this event. Field names can be dynamic and include parts of the event using the %{field} syntax. This property must be specified in pairs. | *remove_field* | property:array |If the filter is successful, remove arbitrary fields from this event. Field names can be dynamic and include parts of the event using the %{field} syntax.