forked from elastic/beats
-
Notifications
You must be signed in to change notification settings - Fork 1
/
json.go
126 lines (108 loc) · 3.26 KB
/
json.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
package reader
import (
"bytes"
"encoding/json"
"fmt"
"time"
"github.com/elastic/beats/libbeat/common"
"github.com/elastic/beats/libbeat/common/jsontransform"
"github.com/elastic/beats/libbeat/logp"
"github.com/elastic/beats/libbeat/publisher/beat"
)
type JSON struct {
reader Reader
cfg *JSONConfig
}
// NewJSONReader creates a new reader that can decode JSON.
func NewJSON(r Reader, cfg *JSONConfig) *JSON {
return &JSON{reader: r, cfg: cfg}
}
// decodeJSON unmarshals the text parameter into a MapStr and
// returns the new text column if one was requested.
func (r *JSON) decodeJSON(text []byte) ([]byte, common.MapStr) {
var jsonFields map[string]interface{}
err := unmarshal(text, &jsonFields)
if err != nil || jsonFields == nil {
logp.Err("Error decoding JSON: %v", err)
if r.cfg.AddErrorKey {
jsonFields = common.MapStr{"error": createJSONError(fmt.Sprintf("Error decoding JSON: %v", err))}
}
return text, jsonFields
}
if len(r.cfg.MessageKey) == 0 {
return []byte(""), jsonFields
}
textValue, ok := jsonFields[r.cfg.MessageKey]
if !ok {
if r.cfg.AddErrorKey {
jsonFields["error"] = createJSONError(fmt.Sprintf("Key '%s' not found", r.cfg.MessageKey))
}
return []byte(""), jsonFields
}
textString, ok := textValue.(string)
if !ok {
if r.cfg.AddErrorKey {
jsonFields["error"] = createJSONError(fmt.Sprintf("Value of key '%s' is not a string", r.cfg.MessageKey))
}
return []byte(""), jsonFields
}
return []byte(textString), jsonFields
}
// unmarshal is equivalent with json.Unmarshal but it converts numbers
// to int64 where possible, instead of using always float64.
func unmarshal(text []byte, fields *map[string]interface{}) error {
dec := json.NewDecoder(bytes.NewReader(text))
dec.UseNumber()
err := dec.Decode(fields)
if err != nil {
return err
}
jsontransform.TransformNumbers(*fields)
return nil
}
// Next decodes JSON and returns the filled Line object.
func (r *JSON) Next() (Message, error) {
message, err := r.reader.Next()
if err != nil {
return message, err
}
var fields common.MapStr
message.Content, fields = r.decodeJSON(message.Content)
message.AddFields(common.MapStr{"json": fields})
return message, nil
}
func createJSONError(message string) common.MapStr {
return common.MapStr{"message": message, "type": "json"}
}
// MergeJSONFields writes the JSON fields in the event map,
// respecting the KeysUnderRoot and OverwriteKeys configuration options.
// If MessageKey is defined, the Text value from the event always
// takes precedence.
func MergeJSONFields(data common.MapStr, jsonFields common.MapStr, text *string, config JSONConfig) {
// The message key might have been modified by multiline
if len(config.MessageKey) > 0 && text != nil {
jsonFields[config.MessageKey] = *text
}
if config.KeysUnderRoot {
// Delete existing json key
delete(data, "json")
var ts time.Time
if v, ok := data["@timestamp"]; ok {
switch t := v.(type) {
case time.Time:
ts = t
case common.Time:
ts = time.Time(ts)
}
}
event := &beat.Event{
Timestamp: ts,
Fields: data,
}
jsontransform.WriteJSONKeys(event, jsonFields, config.OverwriteKeys)
// if timestamp has been set -> add to data
if !event.Timestamp.IsZero() {
data["@timestamp"] = common.Time(event.Timestamp)
}
}
}