关闭

logstash的conditional语句(if语句出错)

标签: filterlogstashcondition
2802人阅读 评论(1) 收藏 举报
分类:

语句的基本形式:
条件判断

使用条件来决定filter和output处理特定的事件。logstash条件类似于编程语言。条件支持if、else if、else语句,可以嵌套。
条件语法如下:

if EXPRESSION {
  ...
} else if EXPRESSION {
  ...
} else {
  ...
}

比较操作有:
相等: ==, !=, <, >, <=, >=
正则: =~(匹配正则), !~(不匹配正则)
包含: in(包含), not in(不包含)
布尔操作:
and(与), or(或), nand(非与), xor(非或)
一元运算符:
!(取反)
()(复合表达式), !()(对复合表达式结果取反)
语句的具体用法请参照参考url

使用中遇到的问题:
1、if[foo] in "String"在执行这样的语句是,报错如下:

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert nil into String>, "backtrace"=>["org/jruby/RubyString.java:4462:in `include?'", "(eval):97:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):95:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):68:in `filter_func'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265:in `filter_batch'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223:in `worker_loop'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}
TypeError: can't convert nil into String
       include? at org/jruby/RubyString.java:4462
     initialize at (eval):97
           each at org/jruby/RubyArray.java:1613
     initialize at (eval):95
           call at org/jruby/RubyProc.java:281
    filter_func at (eval):68
   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265
    worker_loop at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223
  start_workers at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201

原因是没有找到叫做foo的field,无法把该字段值转化成String类型。所以最好要加field if exist判断。

2、判断字段是否存在,代码如下:

if ["foo"] {
  mutate {
    add_field => "bar" => "%{foo}"
  }
}

http://www.ttlsa.com/elk/elk-logstash-configuration-syntax/
http://stackoverflow.com/questions/36947535/logstash-conditional-statement-in-input-block
http://stackoverflow.com/questions/30309096/logstash-check-if-field-exists
http://stackoverflow.com/questions/21438697/logstash-conditional-to-check-if-tag-exists

0
0

查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:47664次
    • 积分:921
    • 等级:
    • 排名:千里之外
    • 原创:42篇
    • 转载:7篇
    • 译文:2篇
    • 评论:9条
    最新评论