zoukankan      html  css  js  c++  java
  • tag_on_failure => [] # prevent default _grokparsefailure tag on real records

    [elk@zjtest7-frontend config]$ cat stdin04.conf 
    input {
        stdin {
        }
    }
    filter {
      # drop sleep events
      grok {
        match => { "message" => "SELECT aaa" }
        add_tag => [ "sleep_aaa" ]
        #tag_on_failure => [] # prevent default _grokparsefailure tag on real records
      }
    
    
      grok {
        match => { "message" => "SELECT bbb" }
        add_tag => [ "sleep_bbb" ]
      }
      }
    output {
    if "sleep_aaa" in [tags]{
     stdout {
      codec=>rubydebug{}
       }
    }
     else if "sleep_bbb" in [tags]{
     stdout {
      codec=>json
       }
    }
    
    }
    
    [elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf 
    Settings: Default pipeline workers: 1
    Pipeline main started
    SELECT bbb
    {"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-15T10:33:12.170Z","host":"0.0.0.0","tags":["_grokparsefailure","sleep_bbb"]}
    
    此时出现了默认的"tags":["_grokparsefailure","sleep_bbb"]
    
    
    /************************************************************
    [elk@zjtest7-frontend config]$ cat stdin04.conf 
    input {
        stdin {
        }
    }
    filter {
      # drop sleep events
      grok {
        match => { "message" => "SELECT aaa" }
        add_tag => [ "sleep_aaa" ]
        tag_on_failure => [] # prevent default _grokparsefailure tag on real records
      }
    
    
      grok {
        match => { "message" => "SELECT bbb" }
        add_tag => [ "sleep_bbb" ]
      }
      }
    output {
    if "sleep_aaa" in [tags]{
     stdout {
      codec=>rubydebug{}
       }
    }
     else if "sleep_bbb" in [tags]{
     stdout {
      codec=>json
       }
    }
    
    }
    a
    [elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf 
    Settings: Default pipeline workers: 1
    Pipeline main started
    SELECT bbb
    {"message":"SELECT bbb","@version":"1","@timestamp":"2016-09-15T10:34:39.194Z","host":"0.0.0.0","tags":["sleep_bbb"]}
    

  • 相关阅读:
    Java魔法堂:String.format详解
    Postgresql 正则表达式
    Linux下安装LAMP(Apache+PHP+MySql)和禅道
    Redis 启动警告错误解决[转]
    Postgresql: UUID的使用
    在Linux下安装RabbitMQ
    Python的包管理工具Pip
    在Linux CentOS 6.6上安装RedisLive
    [转]在Linux CentOS 6.6上安装Python 2.7.9
    在Linux上rpm安装运行Redis 3.0.4
  • 原文地址:https://www.cnblogs.com/hzcya1995/p/13350257.html
Copyright © 2011-2022 走看看