elastic/logstash

Create 'exec' filter

Open

#2,528 建立於 2015年2月6日

在 GitHub 查看
 (1 留言) (1 反應) (0 負責人)Ruby (14,197 star) (3,496 fork)batch import
help wantednew plugin

描述

Migrated from https://logstash.jira.com/browse/LOGSTASH-119:

Would be useful to pipe arbitrary fields through a command to modify them.

Here's an example that would anonymize hostnames or something.

filter {
  exec {
    command => "sed -re 's/\S+\.loggly\.com/anonymizedhost.example.com/'"
    fields => [ "@message", "hostname", "@source_host" ]
  }
}

The default would use only the message to parse

The protocol between logstash and the exec filter must be strict. Something like: for every line emitted, one line must be emitted as the 'new' line. If no changes are made, simply print it unmodified.

deleting the field can be done by printing a blank line

we exec the process once and use stdin for sending data, stdout for reading responses; if it dies, some retries should occur

貢獻者指南