代码之家 › 专栏 › 技术社区 › Ali Ahmad

Logstash类型转换在单变异过滤器中不起作用

dplyr logstash filter

0

Ali Ahmad · 技术社区 · 9 年前

"caller":"caller:123"
"callee":"callee:123"

mutate {
          gsub => [
                   #regex to remove : and every thing before it 
                   "caller", "^[^:]*:", "",                        
                   "callee","^[^:]*:", ""
                  ]
          convert => { 
                     #type conversion from string to integer 
                       "caller" => "integer"
                       "callee" => "integer"                             
                     }                                              
        }

类型转换工作正常,使用了两个单独的变异过滤器

      mutate {
              gsub => [
                       #regex to remove : and every thing before it 
                       "caller", "^[^:]*:", "",                        
                       "callee","^[^:]*:", ""
                      ]
       } 

           mutate {
                     convert => { "caller" => "integer"
                                  "callee"=>  "integer" 
                                 } 

                   }

1 回复 | 直到 9 年前

1

baudsp Alain Collins 9 年前

显然,从源代码来看,转换操作是在gsub操作之前调用的。

https://github.com/logstash-plugins/logstash-filter-mutate/blob/d8936feaa5c7141f96fdfbf1120f23ecdc816275/lib/logstash/filters/mutate.rb#L218

  def filter(event)
    ...
    convert(event) if @convert
    gsub(event) if @gsub