logstash中的类型

logstash中的类型

• array
• boolean
• bytes
• codec
• hash
• number
• password
• path
• string

array

An array can be a single string value or multiple values. If you specify the same setting multiple times, it appends to the array.
example:

path => [ "/var/log/messages", "/var/log/*.log" ]
path => "/data/mysql/mysql.log"

boolean

布尔的，true,false
example:

ssl_enable => true

bytes

A bytes field is a string field that represents a valid unit of bytes. It is a convenient way to declare specific sizes in your plugin options. Both SI (k M G T P E Z Y) and Binary (Ki Mi Gi Ti Pi Ei Zi Yi) units are supported. Binary units are in base-1024 and SI units are in base-1000.

codec

指定输入输出的格式
A codec is the name of Logstash codec used to represent the data. Codecs can be used in both inputs and outputs.

Input codecs provide a convenient way to decode your data before it enters the input. Output codecs provide a convenient way to encode your data before it leaves the output. Using an input or output codec eliminates the need for a separate filter in your Logstash pipeline.

Example:

codec => "json"

hash

A hash is a collection of key value pairs specified in the format “field1” => “value1”.
hash，键值对，用引号引起来。
example:

match => {
  "field1" => "value1"
  "field2" => "value2"
  ...
}

password

A password is a string with a single value that is not logged or printed.
和string差不多，不会被输出。
Example:

my_password => "password"

number

Numbers must be valid numeric values (floating point or integer).
example:

my_password => "password"

Path

A path is a string that represents a valid operating system path.
就是系统路径

A path is a string that represents a valid operating system path.

string

A string must be a single character sequence. Note that string values are enclosed in quotes.
字符串，加引号就行。

name => "Hello world"

具体可以看原文:http://www.elastic.co/guide/en/logstash/current/configuration.html

熟悉了这些类型以后看其他模块就比较好理解了。
比如说grok 的add_field ，需要hash 类型的参数，那就是下面的格式

filter {
  grok {
    add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
  }
}

后记

logstash 是一个非常好的项目，文档全，还有视频，值得学习。