Lostash event API详解

最新推荐文章于 2023-09-19 21:15:59 发布

mvpboss1004

最新推荐文章于 2023-09-19 21:15:59 发布

阅读量2.9k

点赞数 3

分类专栏： Elastic 文章标签： logstash event

本文链接：https://blog.csdn.net/mvpboss1004/article/details/78070300

版权

Elastic 专栏收录该内容

15 篇文章 0 订阅

订阅专栏

我们使用Logstash的ruby filter时，不可避免地要对event进行处理。然而蛋疼的是，Elastic的官方文档https://www.elastic.co/guide/en/logstash/5.6/event-api.html只给出了get和set两个方法的描述。exm？
文档没有，只能看源码了。Event API的描述位于https://github.com/elastic/logstash/blob/master/logstash-core/src/main/java/org/logstash/ext/JrubyEventExtLibrary.java，除了基本的get和set外，还提供了丰富的接口。我们能用到的方法包括：

删除事件：cancel
取消删除事件：uncancel
是否删除：cancelled?
是否包含字段：include?
删除字段：remove
事件转字符串：to_s
事件转hash字典（不含metadata字段）：to_hash
事件转hash字典（含metadata字段）：to_hash_with_metadata
事件转json字符串：to_json
增加tag：tag
取事件时间戳：timestamp

为直观展示各个方法的作用，我们写一个测试配置文件，对这些方法进行测试：

input {
    stdin {
        codec => json
    }
}
filter {
    ruby {
        code => '
            event.cancel
            event.set("cancelled", event.cancelled?)
            event.uncancel
            event.set("include", event.include?("hello"))
            event.remove("hello")
            event.set("to_s", event.to_s)
            event.set("to_hash", event.to_hash)
            event.set("to_hash_with_metadata", event.to_hash_with_metadata)
            event.set("to_json", event.to_json)
            event.tag("_test_tag")
            event.set("timestamp", event.timestamp)
        '
    }
}
output {
    stdout {
        codec => rubydebug
    }
}

测试结果如下。可见，上述方法都能被正常调用。

[root@Miix ~]# logstash -f test.conf
Sending Logstash’s logs to /var/log/logstash which is now configured via log4j2.properties
The stdin plugin is now waiting for input:
{“hello”:”world”}
{
“include” => true,
“@timestamp” => 2017-09-23T05:26:40.265Z,
“to_json” => “{\”include\”:true,\”@timestamp\”:\”2017-09-23T05:26:40.265Z\”,\”to_hash_with_metadata\”:{\”include\”:true,\”@timestamp\”:\”2017-09-23T05:26:40.265Z\”,\”@version\”:\”1\”,\”host\”:\”Miix.mvpboss1004.com\”,\”cancelled\”:true,\”to_s\”:\”2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}\”,\”to_hash\”:{\”include\”:true,\”@timestamp\”:\”2017-09-23T05:26:40.265Z\”,\”@version\”:\”1\”,\”host\”:\”Miix.mvpboss1004.com\”,\”cancelled\”:true,\”to_s\”:\”2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}\”}},\”@version\”:\”1\”,\”host\”:\”Miix.mvpboss1004.com\”,\”cancelled\”:true,\”to_s\”:\”2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}\”,\”to_hash\”:{\”include\”:true,\”@timestamp\”:\”2017-09-23T05:26:40.265Z\”,\”@version\”:\”1\”,\”host\”:\”Miix.mvpboss1004.com\”,\”cancelled\”:true,\”to_s\”:\”2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}\”}}”,
“to_hash_with_metadata” => {
“include” => true,
“@timestamp” => 2017-09-23T05:26:40.265Z,
“@version” => “1”,
“host” => “Miix.mvpboss1004.com”,
“cancelled” => true,
“to_s” => “2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}”,
“to_hash” => {
“include” => true,
“@timestamp” => 2017-09-23T05:26:40.265Z,
“@version” => “1”,
“host” => “Miix.mvpboss1004.com”,
“cancelled” => true,
“to_s” => “2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}”
}
},
“@version” => “1”,
“host” => “Miix.mvpboss1004.com”,
“cancelled” => true,
“to_s” => “2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}”,
“to_hash” => {
“include” => true,
“@timestamp” => 2017-09-23T05:26:40.265Z,
“@version” => “1”,
“host” => “Miix.mvpboss1004.com”,
“cancelled” => true,
“to_s” => “2017-09-23T05:26:40.265Z Miix.mvpboss1004.com %{message}”
},
“tags” => [
[0] “_test_tag”
],
“timestamp” => 2017-09-23T05:26:40.265Z
}