switch to enable JSON processing, JSON detection/parsing after patter…

…n processing
sematext · Oct 7, 2016 · a6ef4aa · a6ef4aa
1 parent 68ff4c1
commit a6ef4aa
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 20 deletions.
diff --git a/lib/parser/parser.js b/lib/parser/parser.js
@@ -429,19 +429,7 @@ LogParser.prototype = {
     if (!line) {
       cbf('empty line', null)
     }
-    var processAsText = false
-    var lines = line.split('\n')
-    for (var i = 0; i < lines.length; i++) {
-      var parsedJson = this.parseJson(lines[i], source)
-      if (parsedJson !== null) {
-        cbf(null, parsedJson)
-      } else {
-        processAsText = true
-      }
-    }
-    if (!processAsText) {
-      return
-    }
+
     var self = this
 
     var br = this.getMultiLineReader(source, function mlReaderCb (data) {
@@ -501,13 +489,22 @@ LogParser.prototype = {
         }
       }
     }
-    this.sourceBlacklist[source] = (this.sourceBlacklist[source] || 0) + 1
-    var rv2 = {'@timestamp': new Date(), message: line}
-    rv2[LOG_SOURCE_FIELD_NAME] = source
-    if (this.globalTransform) {
-      this.globalTransform(source, rv2)
+
+    var parsedJson = null
+    if (this.cfg.json && (this.cfg.json.enabled === true)) {
+      this.parseJson(line, source)
+    }
+    if (parsedJson !== null) {
+      return cbf(null, parsedJson)
+    } else {
+      this.sourceBlacklist[source] = (this.sourceBlacklist[source] || 0) + 1
+      var rv2 = {'@timestamp': new Date(), message: line}
+      rv2[LOG_SOURCE_FIELD_NAME] = source
+      if (this.globalTransform) {
+        this.globalTransform(source, rv2)
+      }
+      return cbf('not found', rv2)
     }
-    return cbf('not found', rv2)
   }
 }
 function parseResultHandler (err, result) {

diff --git a/patterns.yml b/patterns.yml
@@ -28,7 +28,8 @@ maxmindDbDir: /tmp/
 debug: false
 
 # post process all JSON input
-#json:
+json:
+  enabled: true 
 #  autohashFields:
 #    _HOSTNAME: true
 #  removeFields: