I used to config logstash with something like this :
mutate {
copy => {"test" => "test_s3path"}
}
if [test_s3path] =~ /^A-/ {
mutate {
update => { "test_s3path" => "A-INSTANCES" }
}
} else if [test_s3path] =~ /^B-/ {
mutate {
update => { "test_s3path" => "B-INSTANCES" }
}
} else if [test_s3path] =~ /^C-/ {
mutate {
update => { "test_s3path" => "C-INSTANCES" }
}
} else if [test_s3path] =~ /^D-/ {
mutate {
update => { "test_s3path" => "D-INSTANCES" }
}
} else if [test_s3path] =~ /^E-/ {
mutate {
update => { "test_s3path" => "E-INSTANCES" }
}
} else if [test_s3path] =~ /^F-/ {
mutate {
update => { "test_s3path" => "F-INSTANCES" }
}
}
This code is long.
But in Fluentd, with Ruby, you can shorten code to this :
<filter **>
@type record_transformer
enable_ruby
<record>
test_s3path "${\
case record['test_s3path']
when /^A-/ then 'A-INSTANCES'
when /^B-/ then 'B-INSTANCES'
when /^C-/ then 'C-INSTANCES'
when /^D-/ then 'D-INSTANCES'
when /^E-/ then 'E-INSTANCES'
when /^F-/ then 'F-INSTANCES'
else record['test_s3path']
end}"
</record>
</filter>
You should use Ruby code with one line, but if you use "${\ }" format, you can use multiline Ruby code.
Isn't it simple and beautiful? 🥰
'인프라,데이터 > Fluentd, Fluent Bit' 카테고리의 다른 글
Fluentd tail input 로그 1개 손실 & 로그 느리게 들어오는 이유 해결 (0) | 2022.06.29 |
---|---|
Fluentd로 S3 output path에 field(key) 값 넣기 (0) | 2022.06.12 |
argocd 로그 모니터링 (0) | 2022.05.02 |
Fluent Bit에 SQS Output 연결하기(feat. Golang) (0) | 2022.04.14 |
Fluent Bit의 버퍼링Buffering (번역) (0) | 2022.03.20 |