The first requirement actually loads the logstash/namespace.rb file, which defines the modules namespaces for the input, filter, output, and codec plugins.

require "logstash/namespace"

Then, since this is a filter plugin, we will add dependency for the filter:

require "logstash/filters/base"

Similarly, for input, we can add /logstash/inputs/base, and for output /logstash/outputs/base.

Next, for each plugin, we need to declare a class for it, and it should include the required Base class for the filter plugin as well:

class LogStash::Filters::Drop < LogStash::Filters::Base

So, as we have a drop filter, we will declare a class by its name.

Next, we need to specify the name of the plugin that will be used in the Logstash configuration. We do this by declaring config_name:

  config_name "drop"

So, it will be used like this:

filter {
drop {
}
}

We can define as many configuration options as we need for the plugin with this setting. It allows us to set the name of the option, its data type and default value, and specify if it is required:

config :percentage, :validate => :number, :default => 100

The following are the configurations:

Every plugin type (input, filter, output, and codec) has certain methods that they need to implement to initialize instance variables and to execute actual operations inside the plugin.

public
def run(queue)
  #Code which converts messages to event here.
end # def run

  public
  def register
    # nothing to do.
  end

  public
  def filter(event)
    event.cancel if (@percentage == 100 || rand < (@percentage / 100.0))
  end # def filter

  public
  def receive(event)
  end # def event

public
  def encode(event)
    @on_event.call(event, event.to_json)
  end 

   public
  def decode(data)
    data.each do |event|
      yield event
    end
  end

Now, we have seen the structure of a plugin, which gives us a head start on developing one of our own.

In this section, we will demonstrate building a simple filter plugin using the knowledge of the structure of a plugin that we acquired in the previous section.

In this illustration, we will assume that we have a sequence of numbers coming in a stream, and we want to denote them with certain currencies based on a name, which we will pass as a parameter to the plugin. Let's see what our simple currency filter plugin looks like:

# Adds a Currency Symbol to price field
#
#filter {
#    currency{
#        name => "$"
#    }
#}

require "logstash/filters/base"
require "logstash/namespace"

class LogStash::Filters::Currency < LogStash::Filters::Base

config_name "currency"

config :name, :validate => :string, :default => "$"

public
def register
#do nothing
end

public
def filter(event)
    if @name
        msg = @name + event["message"]
        event["message"] = msg
    end
end

end

Let's take a look at how the preceding filter is structured.

First, we have added the dependency for the required classes:

require "logstash/filters/base"
require "logstash/namespace"

Then, we have defined a class for the filter:

class LogStash::Filters::Currency < LogStash::Filters::Base

Next, we named the filter using config_name:

config_name "currency"

Now, we will specify the configuration option needed for this filter as we need the name of the currency to be specified so we can add it to the message. We will define it as follows:

config :name, :validate => :string, :default => "$"

Then, as we don't need to set any instance variables, we have provided an empty register method for the filter:

public
def register
#do nothing
end

Next, we will implement the filter method for the filter plugin, which will take an event and apply the logic for currency:

public
def filter(event)
    if @name
        msg = @name + event["message"]
        event["message"] = msg
    end
end

Here, we will first check the value of the name filter and if it is present, we will add the value in front of the message; otherwise, the filter will be ignored.

Now, filter can be used as follows:

filter {
    currency{
        name => "$"
    }
}

Let's say if your input is 200 after using this filter, each incoming event's output from the Logstash filter plugin will look like this:

{

"@timestamp" => "2015-06-21T14:21:54.123Z",
"message" => "$200",
}

Now, when we have successfully created a plugin, save it as currency.rb in the following folder structure:

logstash-filter-currency
└───lib
|    └───logstash
|        └───filters
|  └───currency.rb
Gemfile
logstash-filter-currency.gemspec  

Now, to create the RubyGem for the folder, we will require a gemfile and a gemspec file present in the logstash-filter-currency top folder.

Let's add some specifications to our gemspec file:

Gem::Specification.new do |s|
  s.name = 'logstash-filter-currency'
  s.version         = '0.1.0'
  s.licenses = ['Apache License (2.0)']
  s.summary = "This plugin adds a currency name before message."
  s.description = "This plugin is used to add core logstash available plugin, to define a new functionality of adding currency symbols for certain messages"
  s.authors = ["Saurabh Chhajed"]
  s.email = '[email protected]'
  s.homepage = "http://saurzcode.in"
  s.require_paths = ["lib"]

  # Files
  s.files = ["lib/logstash/filters/currency.rb"]
  

  # Special flag to let us know this is actually a logstash plugin
  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }

  # Gem dependencies
  s.add_runtime_dependency "logstash-core", '>= 1.4.0', '< 2.0.0'
  s.add_development_dependency 'logstash-devutils'
end       

Save this logstash-filter-currency.gemspec file under the root plugin folder as shown in the folder structure.

It requires Ruby gem bundlers to build gems based on these files, which can be easily installed on the Ruby console using:

$ gem install bundler

More information on using bundler can be found at http://bundler.io/.

Now, we can build the gem using:

$gem build logstash-filter-currency.gemspec

That's it! This should have created a gem named logstash-filter-currency-0.1.0.gem in the same folder.

It can be installed to the existing Logstash installation easily:

$ bin/plugin install /path/to/ logstash-filter-currency-0.1.0.gem

If successful, you should see the plugin listed in:

$bin/plugin list

We can quickly test the plugin using the logstash -e flag option:

bin/logstash -e 'input { stdin{} } filter { currency {  name => "$" } } output {stdout { codec => rubydebug }}'

For the filter plugin, any number that we write will be appended by the $ currency name:

200
{
      "message" => "$200"
      "@version" => "1",
      "@timestamp" => "2015-06-27T19:17:20.230Z",
      "host" => "saurzcode"
}

We can see $ being added to the number 200 that we entered as standard input.

Now, we have successfully created our first Logstash filter plugin and tested it successfully.

Similarly, plugins of input and output types can be created and deployed.