Module org.elasticsearch.dissect
Package org.elasticsearch.dissect

Class DissectParser

java.lang.Object
org.elasticsearch.dissect.DissectParser
public final class DissectParser extends Object
Splits (dissects) a string into its parts based on a pattern.

A dissect pattern is composed of a set of keys and delimiters. For example the dissect pattern: 

%{a} %{b},%{c}
has 3 keys (a,b,c) and two delimiters (space and comma). This pattern will match a string of the form: 
foo bar,baz
and will result a key/value pairing of 
a=foo, b=bar, and c=baz.

Matches are all or nothing. For example, the same pattern will NOT match 

foo bar baz
since all of the delimiters did not match. (the comma did not match)

Dissect patterns can optionally have modifiers. These modifiers instruct the parser to change its behavior. For example the dissect pattern of 

%{a},%{b}:%{c}
would not match 
foo,bar,baz
since there the colon never matches.

Modifiers appear to the left or the right of the key name. The supported modifiers are:

  • -> Instructs the parser to ignore repeating delimiters to the right of the key. Example: 
     pattern: %{a->} %{b} %{c}
 string: foo         bar baz
 result: a=foo, b=bar, c=baz
  • + Instructs the parser to appends this key's value to value of prior key with the same name. Example: 
     pattern: %{a} %{+a} %{+a}
 string: foo bar baz
 result: a=foobarbaz
  • / Instructs the parser to appends this key's value to value of a key based based on the order specified after the /. Requires the + modifier to also be present in the key. Example: 
     pattern: %{a} %{+a/2} %{+a/1}
 string: foo bar baz
 result: a=foobazbar
  • * Instructs the parser to ignore the name of this key, instead use the value of key as the key name. Requires another key with the same name and the & modifier to be the value. Example: 
     pattern: %{*a} %{b} %{&a}
 string: foo bar baz
 result: foo=baz, b=bar
  • & Instructs the parser to ignore this key and place the matched value to a key of the same name with the * modifier. Requires another key with the same name and the * modifier. Example: 
     pattern: %{*a} %{b} %{&a}
 string: foo bar baz
 result: foo=baz, b=bar
  • ? Instructs the parser to ignore this key. The key name exists only for the purpose of human readability. Example 
      pattern: %{a} %{?skipme} %{c}
  string: foo bar baz
  result: a=foo, c=baz

Empty key names patterns are also supported. They behave just like the ? modifier, except the name is not required. The result will simply be ignored. Example 

 pattern: %{a} %{} %{c}
 string: foo bar baz
 result: a=foo, c=baz

Inspired by the Logstash Dissect Filter by Guy Boertje

  • Constructor Details

    • DissectParser

      public DissectParser(String pattern, String appendSeparator)

  • Method Details

    • parse

      public Map<String,String> parse(String inputString)
      Entry point to dissect a string into its parts.
      Parameters:
      inputString - The string to dissect
      Returns:
      the key/value Map of the results
      Throws:
      DissectException - if unable to dissect a pair into its parts.

    • forceParse

      public Map<String,String> forceParse(String inputString)
      Entry point to dissect a string into its parts.
      Parameters:
      inputString - The string to dissect
      Returns:
      the key/value Map of the results
      Throws:
      DissectException - if unable to dissect a pair into its parts.

    • outputKeys

      public Set<String> outputKeys()
      Returns the output keys produced by the instance (excluding named skip keys), e.g. for the pattern "%{a} %{b} %{?c}" the result is [a, b].

      The result is an ordered set, where the entries are in the same order as they appear in the pattern.

      The reference keys are returned with the name they have in the pattern, e.g. for "%{*x} %{&x}" the result is [x].

      Returns:
      the output keys produced by the instance.

    • referenceKeys

      public Set<String> referenceKeys()
      Returns the reference keys present in the pattern, e.g. for the pattern "%{a} %{b} %{*c} %{&c} %{*d} %{&d}" it returns [c, d].

      The result is an ordered set, where the entries are in the same order as they appear in the pattern.

      Returns:
      the reference keys included in the pattern.