Logstash-filter-bitflags - a filter plugin for converting bitfields to a map of flag:bool pairs


(ed miles) #1

I humbly submit my first plugin, which is also my first "project" in Ruby. Please go easy on me :smile:

I wrote this plugin because our data model includes a bitfield and there have been no other options to do this within the existing ELK pipeline (as far as I know). When configured with a map of flags to bit values, this will convert an integer representing the source bitfield to a map of flag and boolean value pairs.

Example

@trans from config:
-- { "trans1" =>1, "trans2" =>2, "trans3" =>4, "trans4" =>8, "trans5" =>12, "trans6" => 16, "trans7" =>32, "trans8" =>64, "trans9" =>128 }

@source integer:
-- { "flag_source": 191 }

this should translate to
-- event[@target] = {"trans7"=>true, "trans8"=>false, "trans9"=>true, "trans1"=>true, "trans2"=>true, "trans3"=>true, "trans4"=>true, "trans5"=>true, "trans6"=>true}

Please let me know if you find this useful, or if you find it broken, or if you have any other comments or questions. I can frequently be found in the freenode IRC channels going by the nick 'edx'.

-Ed


(Clay Gorman) #2

I think this is cool. I usually convert my bit wise to array like 129 would be [1,128] which I use for my bool queries.


(system) #3