elasticsearch - Way to populate Logstash output variable without getting it from an Input? -
Do any output variable to supply a value without dragging it into Logstash Tell A LogStash Input? For example, in my case, I want to create an elastic search index based on an executable run ID (which I was doing with an external script) and must send the logstash. For now though I have been thinking of making a TCP input just to get a PERF run info and then have a filter to match on run ID though it seems a complicated way to do this. For example:
input {tcp {type = & gt; "Perifino" port = & gt; 8888}} If [type] == "perfoffo" {id matches something to remove} output {elastic search {cluster = & gt; "Michelter" manage_template = & gt; False index = & gt; "% {Id} -perftest"}}
I'm not sure that setting the manage_template to the wrong would be really necessary. I've read that this is it.
Update
thanks for that using Nirdesh Ruby can be very easy.
When I was waiting, I tried to use a groke filter:
grok {match = & gt; {"Message" = & gt; "% {WORD: perftype} -% {POSINT: perfid}"}}
This standout has been produced during debugging:
{ "Message" = & gt; "Awperf-14", "@version" = & gt; "1", "@Stemstamp" = & gt; "2014-10-17T20: 01: 19.758Z", "Host" => "0: 0: 0: 0: 0: 0: 0: 1: 33361", "Type" => "Perifonfo", "PaperType" = & gt; "Witchcraft", "Periffid" = & gt; "14"}
I tried to create an index based on this:
index = & gt; So when I had 'awperf-14' for input, I have created these indexes % {%} {%} {%} Perftype} -% {perfid}
awperf-14
Not what I was hoping for Also, this is the% {perftype} -% {perfid} index that is starting to populate, no, at -14, which I actually wanted.
Yes. No one can add you. For the medieval results of their own variables or to permanently use a property named add_field
, most of the filters in this log-in support this property.
So, for your solution, you can use Ruby script to dynamically find the ID and store it in a new variable named id , Which you can use it in output
.
For example:
input {tcp {type = & gt; "Perifino" port = & gt; 8888}} Filters {if [type] == "perfinfo" {ruby {// some processing add_field = & gt; {"Id" = & gt; "Some values"}}}} output {elastic search {cluster = & gt; "Michelter" manage_template = & gt; False index = & gt; "% {Id} -perftest"}}
Comments
Post a Comment