urldecode
editurldecode
editThe urldecode filter is for decoding fields that are urlencoded.
Synopsis
editThis plugin supports the following configuration options:
Required configuration options:
urldecode {
}
Available configuration options:
| Setting | Input type | Required | Default value |
|---|---|---|---|
No |
|
||
No |
|
||
No |
|
||
string, one of |
No |
|
|
No |
|
||
No |
|
||
No |
|
||
No |
|
Details
edit
add_field
edit- Value type is hash
-
Default value is
{}
If this filter is successful, add any arbitrary fields to this event.
Field names can be dynamic and include parts of the event using the %{field}.
Example:
filter {
urldecode {
add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
}
}
[source,ruby]
# You can also add multiple fields at once:
filter {
urldecode {
add_field => {
"foo_%{somefield}" => "Hello world, from %{host}"
"new_field" => "new_static_value"
}
}
}
If the event has field "somefield" == "hello" this filter, on success,
would add field foo_hello if it is present, with the
value above and the %{host} piece replaced with that value from the
event. The second example would also add a hardcoded field.
add_tag
edit- Value type is array
-
Default value is
[]
If this filter is successful, add arbitrary tags to the event.
Tags can be dynamic and include parts of the event using the %{field}
syntax.
Example:
filter {
urldecode {
add_tag => [ "foo_%{somefield}" ]
}
}
[source,ruby]
# You can also add multiple tags at once:
filter {
urldecode {
add_tag => [ "foo_%{somefield}", "taggedy_tag"]
}
}
If the event has field "somefield" == "hello" this filter, on success,
would add a tag foo_hello (and the second example would of course add a taggedy_tag tag).
charset
edit-
Value can be any of:
ASCII-8BIT,Big5,Big5-HKSCS,Big5-UAO,CP949,Emacs-Mule,EUC-JP,EUC-KR,EUC-TW,GB18030,GBK,ISO-8859-1,ISO-8859-2,ISO-8859-3,ISO-8859-4,ISO-8859-5,ISO-8859-6,ISO-8859-7,ISO-8859-8,ISO-8859-9,ISO-8859-10,ISO-8859-11,ISO-8859-13,ISO-8859-14,ISO-8859-15,ISO-8859-16,KOI8-R,KOI8-U,Shift_JIS,US-ASCII,UTF-8,UTF-16BE,UTF-16LE,UTF-32BE,UTF-32LE,Windows-1251,GB2312,Windows-31J,IBM437,IBM737,IBM775,CP850,IBM852,CP852,IBM855,CP855,IBM857,IBM860,IBM861,IBM862,IBM863,IBM864,IBM865,IBM866,IBM869,Windows-1258,GB1988,macCentEuro,macCroatian,macCyrillic,macGreek,macIceland,macRoman,macRomania,macThai,macTurkish,macUkraine,CP950,CP951,stateless-ISO-2022-JP,eucJP-ms,CP51932,EUC-JIS-2004,GB12345,ISO-2022-JP,ISO-2022-JP-2,CP50220,CP50221,Windows-1252,Windows-1250,Windows-1256,Windows-1253,Windows-1255,Windows-1254,TIS-620,Windows-874,Windows-1257,MacJapanese,UTF-7,UTF8-MAC,UTF-16,UTF-32,UTF8-DoCoMo,SJIS-DoCoMo,UTF8-KDDI,SJIS-KDDI,ISO-2022-JP-KDDI,stateless-ISO-2022-JP-KDDI,UTF8-SoftBank,SJIS-SoftBank,BINARY,CP437,CP737,CP775,IBM850,CP857,CP860,CP861,CP862,CP863,CP864,CP865,CP866,CP869,CP1258,Big5-HKSCS:2008,eucJP,euc-jp-ms,EUC-JISX0213,eucKR,eucTW,EUC-CN,eucCN,CP936,ISO2022-JP,ISO2022-JP2,ISO8859-1,CP1252,ISO8859-2,CP1250,ISO8859-3,ISO8859-4,ISO8859-5,ISO8859-6,CP1256,ISO8859-7,CP1253,ISO8859-8,CP1255,ISO8859-9,CP1254,ISO8859-10,ISO8859-11,CP874,ISO8859-13,CP1257,ISO8859-14,ISO8859-15,ISO8859-16,CP878,MacJapan,ASCII,ANSI_X3.4-1968,646,CP65000,CP65001,UTF-8-MAC,UTF-8-HFS,UCS-2BE,UCS-4BE,UCS-4LE,CP932,csWindows31J,SJIS,PCK,CP1251,external,locale -
Default value is
"UTF-8"
Thel character encoding used in this filter. Examples include UTF-8
and cp1252
This setting is useful if your url decoded string are in Latin-1 (aka cp1252)
or in another character set other than UTF-8.
periodic_flush
edit- Value type is boolean
-
Default value is
false
Call the filter flush method at regular interval. Optional.
remove_field
edit- Value type is array
-
Default value is
[]
If this filter is successful, remove arbitrary fields from this event. Fields names can be dynamic and include parts of the event using the %{field} Example:
filter {
urldecode {
remove_field => [ "foo_%{somefield}" ]
}
}
[source,ruby]
# You can also remove multiple fields at once:
filter {
urldecode {
remove_field => [ "foo_%{somefield}", "my_extraneous_field" ]
}
}
If the event has field "somefield" == "hello" this filter, on success,
would remove the field with name foo_hello if it is present. The second
example would remove an additional, non-dynamic field.
remove_tag
edit- Value type is array
-
Default value is
[]
If this filter is successful, remove arbitrary tags from the event.
Tags can be dynamic and include parts of the event using the %{field}
syntax.
Example:
filter {
urldecode {
remove_tag => [ "foo_%{somefield}" ]
}
}
[source,ruby]
# You can also remove multiple tags at once:
filter {
urldecode {
remove_tag => [ "foo_%{somefield}", "sad_unwanted_tag"]
}
}
If the event has field "somefield" == "hello" this filter, on success,
would remove the tag foo_hello if it is present. The second example
would remove a sad, unwanted tag as well.