org.thales.punch.libraries.punchlang.operator

Class DissectOperator

java.lang.Object

org.thales.punch.libraries.punchlang.operator.DissectOperator

public class DissectOperator
extends Object

The dissect operator can be used to extract fields from unstructured data. It does NOT used regexes so it is blazing fast. It is not designed to be a Grok replacement, but rather an alternative approach for certain types of data. Dissect can also be complementary to Grok as a pre-processing tool efficiency doing the heavy lifting.

See the original Logstash dissect plugin documentation at : https://github.com/logstash-plugins/logstash-filter-dissect/tree/master/docs https://www.elastic.co/guide/en/logstash/5.6/plugins-filters-dissect.html

The following example punchlet

 {
     [logs][log] = "Hello World";
     boolean status = dissect("%{a} %{b}").on([logs][log]).into([dissect_result]);
 }
 

will output this root tuple :

  {
      "logs": {
          "log": "Hello World"
      },
      "dissect_result": {
          "a": "Hello",
          "b": "World"
      }
  }
 

Note: the dissect operator return a boolean value. This is very helpful to run conditional block code relying on operator success (or fail).

Constructor Summary

Constructors

Constructor and Description
DissectOperator(org.logstash.dissect.Dissector dissector) Dissect operator constructor.

Method Summary

Modifier and Type	Method and Description
static org.logstash.dissect.Dissector	CompileDissectOperator(String pattern) Pre-compile Dissect() pattern into Dissector objects to call them at runtime.
DissectOperator	debug() Print multiple useful values for debugging.
boolean	into(Tuple tuple) Registers a tuple to hold the operator results.
DissectOperator	on(String input) Set the input data for running this operator.
DissectOperator	on(Tuple input) Set the input data for running this operator.
DissectOperator	overwrite() Request the existing content of your output tuple to be wiped and overwritten with the dissect value.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DissectOperator

public DissectOperator(org.logstash.dissect.Dissector dissector)

Dissect operator constructor. Method called at runtime with a pre-compiled Dissector object

Parameters:

dissector - The pre-compile dissector object to call

Method Detail

CompileDissectOperator

public static org.logstash.dissect.Dissector CompileDissectOperator(String pattern)

Pre-compile Dissect() pattern into Dissector objects to call them at runtime.

Parameters:

pattern - The dissect pattern to compile

Returns:

Dissector object

debug

public DissectOperator debug()

Print multiple useful values for debugging. Of course, do not use this in production. Must be called before '.into()' method.

Returns:

this operator

overwrite

public DissectOperator overwrite()

Request the existing content of your output tuple to be wiped and overwritten with the dissect value.

Returns:

this operator

on

public DissectOperator on(Tuple input)

Set the input data for running this operator. This method throws a PunchRuntimeException if your input tuple does not contain a leaf String value.

Parameters:

input - the data as a Tuple.

Returns:

this operator.

on

public DissectOperator on(String input)

Set the input data for running this operator.

Parameters:

input - the input as a String

Returns:

this operator

into

public boolean into(Tuple tuple)

Registers a tuple to hold the operator results.

Parameters:

tuple - The resulting Tuple

Returns:

True is the dissection works, False in other case