인프라,데이터/Fluentd, Fluent Bit
Fluentd add Record Field by Ruby 'Case when~' Conditional Statements
AimB
2022. 6. 7. 15:07
I used to config logstash with something like this :
mutate {
copy => {"test" => "test_s3path"}
}
if [test_s3path] =~ /^A-/ {
mutate {
update => { "test_s3path" => "A-INSTANCES" }
}
} else if [test_s3path] =~ /^B-/ {
mutate {
update => { "test_s3path" => "B-INSTANCES" }
}
} else if [test_s3path] =~ /^C-/ {
mutate {
update => { "test_s3path" => "C-INSTANCES" }
}
} else if [test_s3path] =~ /^D-/ {
mutate {
update => { "test_s3path" => "D-INSTANCES" }
}
} else if [test_s3path] =~ /^E-/ {
mutate {
update => { "test_s3path" => "E-INSTANCES" }
}
} else if [test_s3path] =~ /^F-/ {
mutate {
update => { "test_s3path" => "F-INSTANCES" }
}
}
This code is long.
But in Fluentd, with Ruby, you can shorten code to this :
<filter **>
@type record_transformer
enable_ruby
<record>
test_s3path "${\
case record['test_s3path']
when /^A-/ then 'A-INSTANCES'
when /^B-/ then 'B-INSTANCES'
when /^C-/ then 'C-INSTANCES'
when /^D-/ then 'D-INSTANCES'
when /^E-/ then 'E-INSTANCES'
when /^F-/ then 'F-INSTANCES'
else record['test_s3path']
end}"
</record>
</filter>
You should use Ruby code with one line, but if you use "${\ }" format, you can use multiline Ruby code.
Isn't it simple and beautiful? 🥰