zoukankan      html  css  js  c++  java
  • tag_on_failure => [] # prevent default _grokparsefailure tag on real records

    [elk@zjtest7-frontend config]$ cat stdin04.conf 
    input {
        stdin {
        }
    }
    filter {
      # drop sleep events
      grok {
        match => { "message" => "SELECT SLEEP" }
        add_tag => [ "sleep_drop" ]
    #    tag_on_failure => [] # prevent default _grokparsefailure tag on real records
      }
      if "sleep_drop" in [tags] {
        drop {}
      }
    }
    
    output {
     stdout {
      codec=>rubydebug{}
       }
     }
    
    [elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf 
    Settings: Default pipeline workers: 1
    Pipeline main started
    SELECT SLEEP
    SELECT SLEEP1
    ddd
    {
           "message" => "ddd",
          "@version" => "1",
        "@timestamp" => "2016-09-15T04:36:14.172Z",
              "host" => "0.0.0.0",
              "tags" => [
            [0] "_grokparsefailure"
        ]
    }
    SELECT SLEEPtetwet
    ffsf
    {
           "message" => "ffsf",
          "@version" => "1",
        "@timestamp" => "2016-09-15T04:36:31.788Z",
              "host" => "0.0.0.0",
              "tags" => [
            [0] "_grokparsefailure"
        ]
    }
    
    /***********************
    [elk@zjtest7-frontend config]$ cat stdin04.conf 
    input {
        stdin {
        }
    }
    filter {
      # drop sleep events
      grok {
        match => { "message" => "SELECT SLEEP" }
        add_tag => [ "sleep_drop" ]
        tag_on_failure => [] # prevent default _grokparsefailure tag on real records
      }
      if "sleep_drop" in [tags] {
        drop {}
      }
    }
    
    output {
     stdout {
      codec=>rubydebug{}
       }
     }
    
    [elk@zjtest7-frontend config]$ ../bin/logstash -f stdin04.conf 
    Settings: Default pipeline workers: 1
    Pipeline main started
    SELECT SLEEP
    SELECT SLEEP4242
    ffs
    {
           "message" => "ffs",
          "@version" => "1",
        "@timestamp" => "2016-09-15T04:37:57.356Z",
              "host" => "0.0.0.0"
    }

  • 相关阅读:
    【leetcode】153. 寻找旋转排序数组中的最小值
    vue下载网络图片
    前端开发项目细节
    如何在手机上预览本地h5页面
    react拖拽添加新组件
    js拖入并复制和拖动改变位置和改变大小
    dva model
    postMessage跨源通信
    react-router
    event.stopPropagation()和event.preventDefault(),return false的区别
  • 原文地址:https://www.cnblogs.com/hzcya1995/p/13350260.html
Copyright © 2011-2022 走看看