Intermediate 1

TimberWinR.ServiceHost/sampleconf.xml

@@ -18,7 +18,8 @@
       <Match field="Text" value="%{SYSLOGLINE}" />               
     </Grok>
     <Mutate>
-      <Rename oldName="timestamp" newName="xtimestamp"/>    
+      <Rename oldName="timestamp" newName="xtimestamp"/>
+      <Remove field="foo%{Index}" />
     </Mutate>
     <Date field="timestamp" target="@timestamp" convertToUTC="true">
       <Pattern>MMM  d HH:mm:ss</Pattern>

TimberWinR/Filters/MutateFilter.cs

@@ -8,14 +8,12 @@ using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
 
 namespace TimberWinR.Filters
-{
-   
-
+{ 
     public class MutateFilter : FilterBase
     {
         public const string TagName = "Mutate";
 
-        public List<Rename> Renames { get; private set; }
+        public List<MutateOperation> Operations { get; private set; }
 
         public static void Parse(List<FilterBase> filters, XElement mutateElement)
         {
@@ -29,27 +27,82 @@ namespace TimberWinR.Filters
 
         MutateFilter(XElement parent)
         {
-            Renames = new List<Rename>();
-            ParseRenames(parent);
+            Operations = new List<MutateOperation>();
+
+            ParseOperations(parent);
         }
 
-        private void ParseRenames(XElement parent)
+        private void ParseOperations(XElement parent)
         {
-            foreach (var e in parent.Elements("Rename"))
+            foreach (var e in parent.Elements())
             {
-                Rename r = new Rename(e.Attribute("oldName").Value, e.Attribute("newName").Value);
-                Renames.Add(r);
-            }
-        }
+                switch(e.Name.ToString())
+                {
+                    case Rename.TagName:
+                        ParseRename(e);
+                        break;
+                    case Remove.TagName:
+                        ParseRemove(e);
+                        break;
+                }                  
+            }                  
+        }      
 
         public override void Apply(JObject json)
         {
-            foreach (var r in Renames)
+            foreach (var r in Operations)
                 r.Apply(json);
         }
 
-        public class Rename
+        public abstract class MutateOperation
         {
+            public abstract void Apply(JObject json);
+        }
+
+        private void ParseRemove(XElement e)
+        {
+            var o = new Remove(e.Attribute("field").Value);
+            Operations.Add(o);
+        }
+        
+        class Remove : MutateOperation
+        {
+            public const string TagName = "Remove";
+            public string FieldName { get; set; }
+
+            public Remove(string fieldName)
+            {
+                FieldName = fieldName;
+            }
+
+            public override void Apply(JObject json)
+            {
+                var fieldName = FieldName;
+                if (fieldName.Contains('%'))
+                    fieldName = ReplaceTokens(fieldName, json);
+                json.Remove(fieldName);
+            }
+
+            private string ReplaceTokens(string fieldName, JObject json)
+            {
+                foreach(var token in json.Children())
+                {
+                    string replaceString = "%{" + token.Path + "}";
+                    fieldName = fieldName.Replace(replaceString, json[token.Path].ToString());
+                }
+                return fieldName;
+            }
+        }
+
+        private void ParseRename(XElement e)
+        {
+            var o = new Rename(e.Attribute("oldName").Value, e.Attribute("newName").Value);
+            Operations.Add(o);
+        }
+
+        class Rename : MutateOperation
+        {
+            public const string TagName = "Rename";
             public string OldName { get; set; }
             public string NewName { get; set; }
 
@@ -58,7 +111,8 @@ namespace TimberWinR.Filters
                 OldName = oldName;
                 NewName = newName;
             }
-            public void Apply(JObject json)
+           
+            public override void Apply(JObject json)
             {
                 json = RenameProperty(json, name => name == OldName ? NewName : name) as JObject;
             }

TimberWinR/Inputs/TailFileInputListener.cs

@@ -36,7 +36,7 @@ namespace TimberWinR.Inputs
 
         private void FileWatcher()
         {
-            var oLogQuery = new LogQuery();
+            
 
             var checkpointFileName = Path.Combine(System.IO.Path.GetTempPath(),
                 string.Format("{0}.lpc", Guid.NewGuid().ToString()));
@@ -56,8 +56,9 @@ namespace TimberWinR.Inputs
             // Execute the query
             while (!CancelToken.IsCancellationRequested)
             {
+                var oLogQuery = new LogQuery();
                 try
-                {
+                {                   
                     var rs = oLogQuery.Execute(query, iFmt);
                     Dictionary<string, int> colMap = new Dictionary<string, int>();
                     for (int col=0; col<rs.getColumnCount(); col++)
@@ -92,11 +93,16 @@ namespace TimberWinR.Inputs
                     }
                     // Close the recordset
                     rs.close();
+                    rs = null;
                 }
                 catch (Exception ex)
                 {
                     LogManager.GetCurrentClassLogger().Error(ex);
                 }
+                finally
+                {
+                    oLogQuery = null;
+                }
                 firstQuery = false;
                 System.Threading.Thread.Sleep(_pollingIntervalInSeconds * 1000);
             }