logstash开发自定义插件

logstash开发自定义插件

1.介绍logstash插件结构

                必须声明的方法：

                

Plugin type	Methods
Input plugin	register and run(queue)
Filter plugin	register and filter(event)
Output plugin	register and receive
Codec plugin	register, encode, decode

查看源码：例如https://github.com/logstash-plugins/logstash-filter-drop如下：

# encoding: utf-8
#首先加载logstash/namespace.rb包，它为输入、flter、输出和编解码器插件提供了模块名称空间。
require "logstash/filters/base"
#由于这是一个过滤器插件，我们将增加对flter的依赖:
require "logstash/namespace"

# Drop filter.
#
# Drops everything that gets to this filter.
#
# This is best used in combination with conditionals, for example:
# [source,ruby]
#     filter {
#       if [loglevel] == "debug" {
#         drop { }
#       }
#     }
#
# The above will only pass events to the drop filter if the loglevel field is
# `debug`. This will cause all events matching to be dropped.
#我们需要为它声明一个类，它还应该包括过滤器插件的必需的基类:
class LogStash::Filters::Drop < LogStash::Filters::Base
#指定插件的名称，这个名称将在LogStash中使用
  config_name "drop"
  # Drop all the events within a pre-configured percentage.
  #
  # This is useful if you just need a percentage but not the whole.
  #
  # Example, to only drop around 40% of the events that have the field loglevel with value "debug".
  #
  #     filter {
  #       if [loglevel] == "debug" {
  #         drop {
  #           percentage => 40
  #         }
  #       }
  #     }
  #我们可以在这个设置中为插件提供尽可能多的解决方案。它允许我们设置选项的名称、它的数据类型和默认值，并指定是否需要它。
  config :percentage, :validate => :number, :default => 100
  public
  def register
    # nothing to do.
  end

  public
  def filter(event)
    event.cancel if (@percentage == 100 || rand < (@percentage / 100.0))
  end # def filter
end # class LogStash::Filters::Drop

构建logstash插件

    文件目录结构如下

logstash-filter-drop
└───lib
|    └───logstash
|        └───filters
|  └───drop.rb
Gemfile

logstash-filter-drop.gemspec  

logstash-filter-drop.gemspec文件：

Gem::Specification.new do |s|

  s.name            = 'logstash-filter-drop'
  s.version         = '3.0.5'
  s.licenses        = ['Apache License (2.0)']
  s.summary         = "Drops all events"
  s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
  s.authors         = ["Elastic"]
  s.email           = 'info@elastic.co'
  s.homepage        = "http://www.elastic.co/guide/en/logstash/current/index.html"
  s.require_paths = ["lib"]

  # Files
  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]

  # Tests
  s.test_files = s.files.grep(%r{^(test|spec|features)/})

  # Special flag to let us know this is actually a logstash plugin
  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "filter" }

  # Gem dependencies
  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"

  s.add_development_dependency 'logstash-devutils'
end

安装 Ruby gem bundlers

$ gem install bundler

build the gem(该组件已用，验证修改名称)

$gem build logstash-filter-drop.gemspec

执行上述命令后，在同级目录hui logstash-filter-drop-3.0.5.gem 

安装：

$ bin/plugin install /path/to/ logstash-filter-3.0.5.gem

查看是否安装成功：

$bin/plugin list