v0_12_filter.conf

# An example config to use filter plugins.
# THIS FEATURE IS SUPPORTED FOR v0.12 AND ABOVE.

# in_forward to generate events to be tested.
# You can send an arbitrary event with an arbitrary tag.
# For example, the following command creates the event
# {"message":"hello world"} with tag = foo
#
# $ echo '{"message":"hello world"}' | fluent-cat foo

<source>
  type forward
  port 24224
</source>

# For all events with the tag "foo", filter it out
# UNLESS the value of the "message" field matches /keep this/
#
# - {"message":"keep this please"} is kept.
# - {"message":"Do not keep"} is filtered out.
# - {"messag22":"keep this please"} is filtered out.

<filter foo>
  type grep
  regexp1  message keep this
</filter>

# Matches the events that was kept by the above filter
<match foo>
  type stdout
</match>

# For all events with the tag "bar", add the machine's hostname with
# the key "hostname" BEFORE forwarding to another instance of Fluentd
# at 123.4.2.4:24224.

<filter bar>
  type record_transformer
  <record>
    hostname ${hostname}
  </record>
</filter>

# By the time it is getting matched here, the event has
# the "hostname" field.
<match bar>
  type forward
  <server>
    host 123.4.2.4
    port 24225
  </server>
</match>

# Composing two filters. For all events with the tag foo.bar,
# 
# 1. The first filter filters out all events that has the field "hello"
# 2. Then, for those events, we downcase the value of the "name" field.
# 
# - {"name":"SADA", "hello":100} gets filtered out
# - {"name":"SADA"} becomes {"name":"sada"}
# - {"last_name":"FURUHASHI"} throws an error because it has no field called "name"

<filter foo.bar>
  type grep
  exclude1 hello .
</filter>

<filter foo.bar>
  type record_transformer
  enable_ruby true
  <record>
    name ${name.downcase}
  </record>
</filter>

<match foo.bar>
  type stdout
</match>