elastic/logstash

Create 'exec' filter

开放

#2,528 创建于 2015年2月6日

 (1 条评论) (1 个反应) (0 位负责人)Ruby (3,496 个派生)batch import
help wantednew plugin

仓库指标

星标
 (14,197 个星标)
PR 合并指标
 (平均合并 4天 19小时) (30 天内合并 50 个 PR)

描述

Migrated from https://logstash.jira.com/browse/LOGSTASH-119:

Would be useful to pipe arbitrary fields through a command to modify them.

Here's an example that would anonymize hostnames or something.

filter {
  exec {
    command => "sed -re 's/\S+\.loggly\.com/anonymizedhost.example.com/'"
    fields => [ "@message", "hostname", "@source_host" ]
  }
}

The default would use only the message to parse

The protocol between logstash and the exec filter must be strict. Something like: for every line emitted, one line must be emitted as the 'new' line. If no changes are made, simply print it unmodified.

deleting the field can be done by printing a blank line

we exec the process once and use stdin for sending data, stdout for reading responses; if it dies, some retries should occur

贡献者指南