在应用中,需要对logstash读取的数据进行字符判断、字符串截取等操作。同时也需要用到正则表达式对某些匹配字符进行替换。
直接上配置文件逻辑:
input{
stdin{
# codec=>rubydebug
}
}
filter{
# codec=>rubydebug
mutate{
split=>["message"," "]
add_field => {
"field1" => "%{[message][0]}"
}
add_field => {
"field2" => "%{[message][1]}"
}
remove_field => ["message"]
}
ruby{
code=>"
length = event['field1'].length
# event['field1'] = event['field1'][length-1,length]
lst = event['field1'][length-1,length]
if lst == '{'
index = event['field1'].rindex(',')
jsonStr = '{' + event['field1'][0,index]
event['field1'] = jsonStr.gsub(/\s/, '')
elsif lst == '}'
index = event['field1'].rindex(']')
jsonStr = '{' + event['field1'][0,index]
event['field1'] = jsonStr.gsub(/\s/, '')
end
# event['field1'] = event['field1'].rindex(',')
# event['field1'] = Time.parse(event['field1']).to_f*1000
"
}
# json{
# source => "field1"
# target => "field1"
# }
}
output{
stdout{
codec=>rubydebug
}
}
在ruby中,code=>中写入自己的处理逻辑,另外在logstash中每一次数据读取到的东西都是一个事件。
具体的ruby语法参考api
http://www.ziqiangxuetang.com/ruby/ruby-string.html
http://blog.sina.com.cn/s/blog_8184e03301013iqj.html