Logstash Ruby Filter script to replace a structured event's data with a single field containing a JSON-serialized string representing the same data.

replace-with-serialzied.logstash-filter-ruby.rb

###############################################################################
# replace-with-serialzied.logstash-filter-ruby.rb
# ---------------------------------
# A script for a Logstash Ruby Filter to replace the event's contents with a
# single field containing a string JSON-encoded representation of the event.
#
# This filter _MUTATES_ the event, removing all DATA-keys while leaving METADATA
# in-tact.
#
###############################################################################
#
# Copyright 2022 Ry Biesemeyer
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
def register(params)
  params = params.dup

  # target: if provided, the target field to place the serialized event
  #         (default: "message")
  @target = params.delete('target') || 'message'

  @keep_timestamp = extract_optional_boolean(params, 'keep_timestamp', false)

  params.empty? || report_configuration_error("unknown value(s) for script_params: #{params.keys}.")
end

def report_configuration_error(message)
  raise LogStash::ConfigurationError, message
end

def extract_optional_boolean(params, param_name, default=false)
  return default unless params.include?(param_name)

  value_given = params.delete(param_name)
  case value_given
  when true, 'true', 'TRUE' then true
  when false, 'false', 'FALSE' then false
  else
    report_configuration_error("unsupported value for script_params `#{param_name}`: #{value_given.inspect}")
  end
end

def filter(event)
  # stash away a serialized version of the main event
  # as a local varaible
  serialzed = event.to_json
  timestamp = event.timestamp

  # remove all DATA keys
  event.to_hash.keys.each do |key|
    event.remove(key)
  end

  # set a single field with our serialized event
  event.set(@target, serialzed)
  event.timestamp = timestamp if @keep_timestamp

  return [event]
rescue => e
  log_meta = {exception: e.message}
  log_meta.update(:backtrace, e.backtrace) if logger.debug?
  logger.error('failed to replace event with serialzed version of itself', log_meta)
  event.tag('_replace_with_serialized_error')
  return [event]
end