logstash-在过滤器内部使用ruby代码 [英] logstash - use ruby code inside of a filter

问题描述

是否可以在过滤器内部使用ruby代码?像这样的东西:

filter {
 csv{
   ruby {
      code => "
            fieldArray = event['message'].split(',')
            for field in fieldArray
                event[field] = field
            end
        "
        }
   }
}

解决方案

不，csv {}是一个过滤器，而ruby {}是一个过滤器，因此它们不会像您显示的那样相互嵌套.

您尚未描述问题，但您正在寻找的只是使用ruby {}.

有关该问题的更多信息，这里有更多注释:

Logstash一次运行一个事件，因此对于csv {}，它一次处理文件中的一行.即使使用ruby {}过滤器，您也看不到整个输入.

但是，由于标题行是第一行，因此您应该能够放入ruby {}，将该行的列塞进一个持久变量中，对于后续的行，遍历ruby中的字段并重命名它们

您还可以将csv {}过滤器扩展为可识别标头"，这将使大量的logstash用户受益.

is it possible to use ruby code inside of a filter? something like this:

filter {
 csv{
   ruby {
      code => "
            fieldArray = event['message'].split(',')
            for field in fieldArray
                event[field] = field
            end
        "
        }
   }
}

解决方案

No, csv{} is a filter and ruby{} is a filter, so they don't nest inside each other as you've shown.

You haven't described the problem, but perhaps just using ruby{} is what you're looking for.

EDIT: with more information on the problem, here are some more notes:

Logstash runs one event at a time, so for csv{}, it's processing one line from the file at a time. Even with the ruby{} filter, you don't get a look at the entire input.

Since the header row is first, however, you should be able to drop into ruby{}, tuck away the columns of this row into a persistent variable, and, for subsequent rows, loop through the fields in ruby and rename them.

You could also extend the csv{} filter to be "header aware", which would benefit a good population of logstash users.

这篇关于logstash-在过滤器内部使用ruby代码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！