在logstash筛选器条件中使用ruby变量
我有以下日志存储配置:在logstash筛选器条件中使用ruby变量,logstash,logstash-configuration,Logstash,Logstash Configuration,我有以下日志存储配置: input { stdin { } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } filter { ruby { code => " @@exists_pattern = ['foo', 'bar'].any?{ |pattern| event.get('message').inclu
input { stdin { } }
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
filter {
ruby {
code => "
@@exists_pattern = ['foo', 'bar'].any?{ |pattern| event.get('message').include?(pattern) }
event.add('keep_line', @@exists_pattern)
"
}
if not [keep_line] { drop { } }
grok {
match => {
"message" => '%{IP:serverip} \[%{HTTPDATE:my_timestamp}\]'
}
}
date {
match => [ "my_timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
target => "@timestamp"
}
}
但是,当我尝试使用此配置文件运行logstash时,会出现以下错误:
[ERROR][logstash.agent] Cannot create pipeline {:reason=>"Expected one of #, ( at line 30, column 10 (byte 923) after filter {\n # grok...
如何在if指令中使用ruby代码块(event['keep_line'])中设置的变量?在Logstash筛选器的if条件中不能使用否定。尝试将布尔条件转换为正