logstash的conditional语句(if语句出错)

翻译 2016年08月31日 12:48:13

语句的基本形式:
条件判断

使用条件来决定filter和output处理特定的事件。logstash条件类似于编程语言。条件支持if、else if、else语句,可以嵌套。
条件语法如下:

if EXPRESSION {
  ...
} else if EXPRESSION {
  ...
} else {
  ...
}

比较操作有:
相等: ==, !=, <, >, <=, >=
正则: =~(匹配正则), !~(不匹配正则)
包含: in(包含), not in(不包含)
布尔操作:
and(与), or(或), nand(非与), xor(非或)
一元运算符:
!(取反)
()(复合表达式), !()(对复合表达式结果取反)
语句的具体用法请参照参考url

使用中遇到的问题:
1、if[foo] in "String"在执行这样的语句是,报错如下:

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert nil into String>, "backtrace"=>["org/jruby/RubyString.java:4462:in `include?'", "(eval):97:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):95:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):68:in `filter_func'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265:in `filter_batch'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223:in `worker_loop'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}
TypeError: can't convert nil into String
       include? at org/jruby/RubyString.java:4462
     initialize at (eval):97
           each at org/jruby/RubyArray.java:1613
     initialize at (eval):95
           call at org/jruby/RubyProc.java:281
    filter_func at (eval):68
   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265
    worker_loop at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223
  start_workers at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201

原因是没有找到叫做foo的field,无法把该字段值转化成String类型。所以最好要加field if exist判断。

2、判断字段是否存在,代码如下:

if ["foo"] {
  mutate {
    add_field => "bar" => "%{foo}"
  }
}

http://www.ttlsa.com/elk/elk-logstash-configuration-syntax/
http://stackoverflow.com/questions/36947535/logstash-conditional-statement-in-input-block
http://stackoverflow.com/questions/30309096/logstash-check-if-field-exists
http://stackoverflow.com/questions/21438697/logstash-conditional-to-check-if-tag-exists

相关文章推荐

Logstash的数据类型和基本语法

From:http://www.ttlsa.com/elk/elk-logstash-configuration-syntax/ logstash支持的数据类型有: array 数组...

logstash 根据type 判断输出

# 更多ELK资料请访问 http://devops.taobao.com 一、配置前需要注意: 1.Use chmod to modify nginx log file privilege. E...

坑爹的logstash条件判断

logstash可以使用条件判断来控制filter的执行。官方说明见Accessing Event Data and Fields in the Configuration。支持的运算符包括: equ...

logstash 学习小记

简单的介绍了logstash,给出一些简单实用的examples

Logstash 配置总结

#整个配置文件分为三部分:input,filter,output #参考这里的介绍 https://www.elastic.co/guide/en/logstash/current/configur...
  • xfg0218
  • xfg0218
  • 2016年10月31日 11:02
  • 4123

logstash 通过type判断

[elk@zjtest7-frontend type]$ cat input.conf input { file { type => "type_a"...

logstash入门(简单而全面)

原文地址:http://logstash.net/docs/1.4.2/tutorials/getting-started-with-logstash 英语水平有限,如果有错误请各位指正 ...

logstash 条件判断语句

logstash 条件判断语句 使用条件来决定filter和output处理特定的事件。logstash条件类似于编程语言。条件支持if、else if、else语句,可以嵌套。  比较操作有: ...

logstash 向elasticsearch写入数据,如何指定多个数据template

logstash 向elasticsearch写入数据,如何指定多个数据template?

logstash input output filter 插件总结

Logstash学习记录 官方文档logstash2.3 document: https://www.elastic.co/guide/en/logstash/current/index.ht...
  • yesicatt
  • yesicatt
  • 2016年08月03日 16:21
  • 12782
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:logstash的conditional语句(if语句出错)
举报原因:
原因补充:

(最多只允许输入30个字)