mirror of
https://github.com/elastic/logstash.git
synced 2025-04-24 06:37:19 -04:00
parent
c7e1254a03
commit
25aa771643
1 changed files with 29 additions and 27 deletions
|
@ -9,8 +9,8 @@ class LogStash::Filters::Base < LogStash::Plugin
|
|||
|
||||
config_name "filter"
|
||||
|
||||
# Note that all of the specified routing options (type,tags.exclude\_tags,include\_fields,exclude\_fields)
|
||||
# must be met in order for the event to be handled by the filter.
|
||||
# Note that all of the specified routing options (`type`,`tags`,`exclude_tags`,`include_fields`,
|
||||
# `exclude_fields`) must be met in order for the event to be handled by the filter.
|
||||
|
||||
# The type to act on. If a type is given, then this filter will only
|
||||
# act on messages with the same type. See any input plugin's "type"
|
||||
|
@ -18,25 +18,27 @@ class LogStash::Filters::Base < LogStash::Plugin
|
|||
# Optional.
|
||||
config :type, :validate => :string, :default => "", :deprecated => "You can achieve this same behavior with the new conditionals, like: `if [type] == \"sometype\" { %PLUGIN% { ... } }`."
|
||||
|
||||
# Only handle events with all/any (controlled by include\_any config option) of these tags.
|
||||
# Only handle events with all/any (controlled by `include_any` config option) of these tags.
|
||||
# Optional.
|
||||
config :tags, :validate => :array, :default => [], :deprecated => "You can achieve similar behavior with the new conditionals, like: `if \"sometag\" in [tags] { %PLUGIN% { ... } }`"
|
||||
|
||||
# Only handle events without all/any (controlled by exclude\_any config
|
||||
# Only handle events without all/any (controlled by `exclude_any` config
|
||||
# option) of these tags.
|
||||
# Optional.
|
||||
config :exclude_tags, :validate => :array, :default => [], :deprecated => "You can achieve similar behavior with the new conditionals, like: `if !(\"sometag\" in [tags]) { %PLUGIN% { ... } }`"
|
||||
|
||||
# If this filter is successful, add arbitrary tags to the event.
|
||||
# Tags can be dynamic and include parts of the event using the %{field}
|
||||
# syntax. Example:
|
||||
# Tags can be dynamic and include parts of the event using the `%{field}`
|
||||
# syntax.
|
||||
#
|
||||
# Example:
|
||||
# [source,ruby]
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# add_tag => [ "foo_%{somefield}" ]
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# [source,ruby]
|
||||
# # You can also add multiple tags at once:
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
|
@ -44,45 +46,46 @@ class LogStash::Filters::Base < LogStash::Plugin
|
|||
# }
|
||||
# }
|
||||
#
|
||||
# If the event has field "somefield" == "hello" this filter, on success,
|
||||
# would add a tag "foo_hello" (and the second example would of course add a "taggedy_tag" tag).
|
||||
# If the event has field `"somefield" == "hello"` this filter, on success,
|
||||
# would add a tag `foo_hello` (and the second example would of course add a `taggedy_tag` tag).
|
||||
config :add_tag, :validate => :array, :default => []
|
||||
|
||||
# If this filter is successful, remove arbitrary tags from the event.
|
||||
# Tags can be dynamic and include parts of the event using the %{field}
|
||||
# syntax. Example:
|
||||
# Tags can be dynamic and include parts of the event using the `%{field}`
|
||||
# syntax.
|
||||
#
|
||||
# Example:
|
||||
# [source,ruby]
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# remove_tag => [ "foo_%{somefield}" ]
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# [source,ruby]
|
||||
# # You can also remove multiple tags at once:
|
||||
#
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# remove_tag => [ "foo_%{somefield}", "sad_unwanted_tag"]
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# If the event has field "somefield" == "hello" this filter, on success,
|
||||
# would remove the tag "foo_hello" if it is present. The second example
|
||||
# If the event has field `"somefield" == "hello"` this filter, on success,
|
||||
# would remove the tag `foo_hello` if it is present. The second example
|
||||
# would remove a sad, unwanted tag as well.
|
||||
config :remove_tag, :validate => :array, :default => []
|
||||
|
||||
# If this filter is successful, add any arbitrary fields to this event.
|
||||
# Field names can be dynamic and include parts of the event using the %{field}
|
||||
# Example:
|
||||
# Field names can be dynamic and include parts of the event using the `%{field}`.
|
||||
#
|
||||
# Example:
|
||||
# [source,ruby]
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# [source,ruby]
|
||||
# # You can also add multiple fields at once:
|
||||
#
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# add_field => {
|
||||
|
@ -92,32 +95,31 @@ class LogStash::Filters::Base < LogStash::Plugin
|
|||
# }
|
||||
# }
|
||||
#
|
||||
# If the event has field "somefield" == "hello" this filter, on success,
|
||||
# would add field "foo_hello" if it is present, with the
|
||||
# value above and the %{host} piece replaced with that value from the
|
||||
# If the event has field `"somefield" == "hello"` this filter, on success,
|
||||
# would add field `foo_hello` if it is present, with the
|
||||
# value above and the `%{host}` piece replaced with that value from the
|
||||
# event. The second example would also add a hardcoded field.
|
||||
config :add_field, :validate => :hash, :default => {}
|
||||
|
||||
# If this filter is successful, remove arbitrary fields from this event.
|
||||
# Fields names can be dynamic and include parts of the event using the %{field}
|
||||
# Example:
|
||||
#
|
||||
# [source,ruby]
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# remove_field => [ "foo_%{somefield}" ]
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# [source,ruby]
|
||||
# # You can also remove multiple fields at once:
|
||||
#
|
||||
# filter {
|
||||
# %PLUGIN% {
|
||||
# remove_field => [ "foo_%{somefield}", "my_extraneous_field" ]
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# If the event has field "somefield" == "hello" this filter, on success,
|
||||
# would remove the field with name "foo_hello" if it is present. The second
|
||||
# If the event has field `"somefield" == "hello"` this filter, on success,
|
||||
# would remove the field with name `foo_hello` if it is present. The second
|
||||
# example would remove an additional, non-dynamic field.
|
||||
config :remove_field, :validate => :array, :default => []
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue