본문 바로가기

인프라,데이터/Fluentd, Fluent Bit

Fluentd add Record Field by Ruby 'Case when~' Conditional Statements

I used to config logstash with something like this :

    mutate {
        copy =>  {"test" => "test_s3path"}
    }

    if [test_s3path] =~ /^A-/ {
        mutate {
            update => { "test_s3path" => "A-INSTANCES" }
        }
    } else if [test_s3path] =~ /^B-/ {
        mutate {
            update => { "test_s3path" => "B-INSTANCES" }
        }
    } else if [test_s3path] =~ /^C-/ {
        mutate {
            update => { "test_s3path" => "C-INSTANCES" }
        }
    } else if [test_s3path] =~ /^D-/ {
        mutate {
            update => { "test_s3path" => "D-INSTANCES" }
        }
    } else if [test_s3path] =~ /^E-/ {
        mutate {
            update => { "test_s3path" => "E-INSTANCES" }
        }
    } else if [test_s3path] =~ /^F-/ {
        mutate {
            update => { "test_s3path" => "F-INSTANCES" }
        }
    }

This code is long. 

But in Fluentd, with Ruby, you can shorten code to this :

<filter **>
  @type record_transformer
  enable_ruby
  <record>
    test_s3path "${\
      case record['test_s3path']
      when /^A-/ then 'A-INSTANCES'
      when /^B-/ then 'B-INSTANCES'
      when /^C-/ then 'C-INSTANCES'
      when /^D-/ then 'D-INSTANCES'
      when /^E-/ then 'E-INSTANCES'
      when /^F-/ then 'F-INSTANCES'
      else record['test_s3path']
      end}"
  </record>
</filter>

You should use Ruby code with one line, but if you use "${\ }" format, you can use multiline Ruby code. 

Isn't it simple and beautiful? 🥰