I'm a newbie at Logstash plugin development and, as both a work task and a training exercise, I'm developing a filter plugin that involves querying an SQLite database on each event. As of this moment, I understand the following:
The Logstash register method is like an initialize method.
Which typically only runs once, so this is where I connect to my SQLite database and create my @database object as an instance variable.
The plugin’s filter method is where the actual filtering work takes place!
So this method runs every time an event is to be processed, therefore It is here where I work with the @database query's @result_set; however, this poses the question of where do I make sure that the database is closed? If the register method is run only once, and I close the database connection at the end of the filter method execution, wouldn't that deny the querying of the data in the following event process, since the database is now closed?
Which typically only runs once, so this is where I connect to my SQLite database and create my @database object as an instance variable.
This only works if connections are never closed during execution. I'd instead create connections whenever needed so that a dropped connection can be recovered without a Logstash restart.
where do I make sure that the database is closed?
Is an explicit close necessary? If Logstash shuts down the socket connection will be closed by the kernel which will be picked up by the peer.
No, actually I was just trying to comply with good programming practices as it is pointed out often in most SQLite tutorials. Didn't know that it could be left to the kernel to handle. Thanks for the update. I'll test it and come back with the results.
Hello again! Already checked your approach and it solves my initial problem. Now I'm trying to work on performance but, since that is out of the scope of my original question, I'm marking this as the solution. Thanks a lot.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.