forked from fluent/fluentd
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add an example config for v0.12's filter
to be the basis for the upcoming documentation
- Loading branch information
Showing
1 changed file
with
78 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,78 @@ | ||
# An example config to use filter plugins. | ||
# THIS FEATURE IS SUPPORTED FOR v0.12 AND ABOVE. | ||
|
||
# in_forward to generate events to be tested. | ||
# You can send an arbitrary event with an arbitrary tag. | ||
# For example, the following command creates the event | ||
# {"message":"hello world"} with tag = foo | ||
# | ||
# $ echo '{"message":"hello world"}' | fluent-cat foo | ||
|
||
<source> | ||
type forward | ||
port 24224 | ||
</source> | ||
|
||
# For all events with the tag "foo", filter it out | ||
# UNLESS the value of the "message" field matches /keep this/ | ||
# | ||
# - {"message":"keep this please"} is kept. | ||
# - {"message":"Do not keep"} is filtered out. | ||
# - {"messag22":"keep this please"} is filtered out. | ||
|
||
<filter foo> | ||
type grep | ||
regexp1 message keep this | ||
</filter> | ||
|
||
# Matches the events that was kept by the above filter | ||
<match foo> | ||
type stdout | ||
</match> | ||
|
||
# For all events with the tag "bar", add the machine's hostname with | ||
# the key "hostname" BEFORE forwarding to another instance of Fluentd | ||
# at 123.4.2.4:24224. | ||
|
||
<filter bar> | ||
type record_transformer | ||
<record> | ||
hostname ${hostname} | ||
</record> | ||
</filter> | ||
|
||
# By the time it is getting matched here, the event has | ||
# the "hostname" field. | ||
<match bar> | ||
type forward | ||
<server> | ||
host 123.4.2.4 | ||
port 24225 | ||
</server> | ||
</match> | ||
|
||
# Composing two filters. For all events with the tag foo.bar, | ||
# | ||
# 1. The first filter filters out all events that has the field "hello" | ||
# 2. Then, for those events, we downcase the value of the "name" field. | ||
# | ||
# - {"name":"SADA", "hello":100} gets filtered out | ||
# - {"name":"SADA"} becomes {"name":"sada"} | ||
# - {"last_name":"FURUHASHI"} throws an error because it has no field called "name" | ||
|
||
<filter foo.bar> | ||
type grep | ||
exclude1 hello . | ||
</filter> | ||
|
||
<filter foo.bar> | ||
type record_transformer | ||
enable_ruby true | ||
<record> | ||
name ${name.downcase} | ||
</record> | ||
</filter> | ||
|
||
<match foo.bar> | ||
type stdout | ||
</match> |