Logstash 什么'；这是将数字变量传递到油门过滤器的最大年龄字段的正确方法

如何将整数字段传递到油门滤清器块的

max\u age

参数？我无法通过下面显示的错误

[ERROR] 2019-02-18 20:19:30.005 [Converge PipelineAction::Create<main>] throttle - Invalid setting for throttle filter plugin:

  filter {
    throttle {
      # This setting must be a number
      # Expected number, got "throttle_max_age" (type throttle_max_age)
      max_age => ["throttle_max_age"]
      ...
    }
  }

---

不幸的是，目前似乎不可能做到这一点，因为在加载Logstash配置时会验证该值，并且它需要一个具体的数字值

下面是throttle插件的源代码，它检查值是否为数字：

与允许字段替换的时段值比较：

作为一种解决方法，如果max_age的值只有几个案例，那么可以修改条件并在那里放置两个节流过滤器。例如：

# Specific alert frequencies for different alert categories
if ["voltage_category] == "normal" {
    # Voltage normal
    throttle {
        key => "%{eventkey}"
        # 86400 = one day
        period => 86400
        # Two days and ten seconds
        max_age => 172810
        before_count => -1
        after_count => 1
        add_tag => "throttled"
    }
} else {
    # Abnormal event. Throttle less, so more notifications are transmitted
    throttle {
        key => "%{eventkey}"
        period => 15
        max_age => 180
        before_count => -1
        after_count => 1
        add_tag => "throttled"
    }
    # end of voltage abnormal
} 

---

电压类别引用不正确。

# Specific alert frequencies for different alert categories
if ["voltage_category] == "normal" {
    # Voltage normal
    throttle {
        key => "%{eventkey}"
        # 86400 = one day
        period => 86400
        # Two days and ten seconds
        max_age => 172810
        before_count => -1
        after_count => 1
        add_tag => "throttled"
    }
} else {
    # Abnormal event. Throttle less, so more notifications are transmitted
    throttle {
        key => "%{eventkey}"
        period => 15
        max_age => 180
        before_count => -1
        after_count => 1
        add_tag => "throttled"
    }
    # end of voltage abnormal
}