diff --git a/configs/ps-trace.conf b/configs/ps-trace.conf index 666dc6e..4adb30b 100644 --- a/configs/ps-trace.conf +++ b/configs/ps-trace.conf @@ -24,9 +24,10 @@ filter { } } + ruby { path => "/usr/share/logstash/filters/trace.rb" } - + if ![tags] { # for problematic things don't remove fields mutate{ remove_field => ["type", "test", "result", "@timestamp"] @@ -38,4 +39,5 @@ filter { output { pipeline { send_to => ["es-output"] } + pipeline { send_to => ["nebraska"] } } \ No newline at end of file diff --git a/filters/trace.rb b/filters/trace.rb index ddd13b6..7bc4700 100644 --- a/filters/trace.rb +++ b/filters/trace.rb @@ -4,6 +4,8 @@ def filter(event) hs = event.get('[result][paths]').first() dest = event.get('[dest]') +# TODO add lookups for dns names from memcached. + c = 1 path_complete = true destination_reached = false @@ -20,6 +22,7 @@ def filter(event) asns.push(h["as"]["number"]) else asns.push(0) + # TODO here do an asns lookup end else path_complete = false