标签子集到第二个输出 [英] Subset of tag to a second output

问题描述

我有一项服务，我正在尝试从中记录日志并将日志发送到某些位置，具体取决于它们所指的是什么.流利的道理.目前，我只是将所有内容都保留到s3中，并且一切正常.但是，我现在希望将一小部分子集(以"ACTION:"开头的任何行)也发送到mongo数据库.我仍然希望将所有内容发送到s3.

I've got a service I'm trying to record logs from and send them to certain locations depending on what they refer to. Fluentd makes sense. Currently, I just have everything being chucked off to s3, and that works fine. However I now want a small subset (any line beginning with the phrase "ACTION:") to also be sent to a mongo database. I still want everything sent to s3.

我在这里有这个配置文件，这当然是行不通的

I have this config file here, which of course isn't going to work

<source>
  @type  forward
  @id    input
  @label mainstream
  port   24224
</source>

<label @mainstream>

  <match foo.**>
    @type copy

    <store>
      @type s3

      ...
    </store>
    <store>
      @type rewrite_tag_filter
      rewriterule1 log "^ACTION:" foo.bar
    </store>

  </match>

  <match foo.bar>
    @type mongo

    ...
  </matc>
</label>

一旦我们到达第一个匹配标记，所有这些都将被收集并停止，rewrite_tag_filter的正常行为似乎不会传递给<store>.

It's all going to be collected and stopped once we've got to the first match tag, the normal behaviour of the rewrite_tag_filter doesn't seem to pass on past the <store>.

我尝试过的其他东西.

• 复制s3 store，因此使用了两次.但是我不希望我的s3输出被拆分.
• 在另一个端口处转发给自己，通过另一个标签运行源，但是它不会连接.

• Copying the s3 store so it's used twice. However I don't want my s3 outputs to be split.
• Forward to itself at a different port, run the source through a different label, however it wouldn't connect.

我确定我要问的不是太疯狂.以前有人做过这样的事吗?

I'm sure what I'm asking isn't too insane. Has anyone done something like this before?

推荐答案

只需注意重新标记的内容.如果您使用与上述匹配项匹配的内容，则该内容将继续进行，因此需要有所不同.在这种情况下，即使标签有所不同，因为我是从foo开始的，所以它不会越过<match foo.**>.

Just need to be careful with what to retag. If you use something which will be matched by the above match, it won't move on, so it needs to be different. In this case, even though the tag was different, because I was starting it with foo, it wouldn't move on past the <match foo.**>.

<source>
  @type  forward
  @id    input
  @label mainstream
  port   24224
</source>

<label @mainstream>

  <match foo.**>
    @type copy

    <store>
      @type s3

      ...
    </store>
    <store>
      @type rewrite_tag_filter
      # Changed tag from foo.bar to this
      rewriterule1 log "^ACTION:" totally.different.tag.name
    </store>

  </match>


  # the new totally.different.tag.name won't get caught by the 
  # first <match foo.**> so it will actually reach this one
  <match totally.different.tag.name>
    @type mongo

    ...
  </match>
</label>

这篇关于标签子集到第二个输出的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！