[elk@zjtest7-frontend config]$ cat stdin04.conf
input {
stdin {
}
}
filter {
# drop sleep events
grok {
match => { "message" => "SELECT aaa" }
add_tag => [ "sleep_aaa" ]
#tag_on_failure => [] # prevent default _grokparsefailure tag on real records
}
grok {
match => { "message" => "SELECT bbb" }
add_tag => [ "sleep_bbb" ]
}
}
output {
if "sleep_aaa" in [tags]{
stdout {
codec=>rubydebug{}
}
}
else if "sleep_bbb" in [tags]{
stdout {
codec=>json
}
}
}
[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf
Settings: Default pipeline workers: 1
Pipeline main started
SELECT bbb
{"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-15T10:33:12.170Z","host":"0.0.0.0","tags":[
tag_on_failure => [] # prevent default _grokparsefailure tag on real records
最新推荐文章于 2022-03-25 12:07:06 发布