help wantednew plugin
描述
Migrated from https://logstash.jira.com/browse/LOGSTASH-119:
Would be useful to pipe arbitrary fields through a command to modify them.
Here's an example that would anonymize hostnames or something.
filter { exec { command => "sed -re 's/\S+\.loggly\.com/anonymizedhost.example.com/'" fields => [ "@message", "hostname", "@source_host" ] } }The default would use only the
messageto parseThe protocol between logstash and the exec filter must be strict. Something like: for every line emitted, one line must be emitted as the 'new' line. If no changes are made, simply print it unmodified.
deleting the field can be done by printing a blank line
we exec the process once and use stdin for sending data, stdout for reading responses; if it dies, some retries should occur