Best practise method to split events and perform filtering to those events


Hi All,

I'm trying to do something that I'm not seeing an easy way to do and I'm not all that familiar with Ruby, so I'd prefer to use standard filters when/where possible.

Here's the scope of what I'm trying to achieve.

I receive a collectd-snmp polled event for IF-MIB::ifInOctets/IF-MIB::ifOutOctets into Logstash (2.4.1).

The event comes in with fields dstypes, dsnames and values which are all arrays and match up.

An example of the event fields mentioned would be:

dsnames = ['rx','tx']
dstype = ['derive','derive']
values = ['481752','12852']

What I'd like to achieve is splitting this into one event per array entry, ending up with:

Split off event #1
dsname = rx
dstype = derive
value = 481752

Split off event #2
dsname = tx
dstype = derive
value = 12852

Original event canceled.

On top of that, I then want to add a new field to each event which is the value * 8 (to get bits instead of bytes).

Is this all actually achievable using standard filters (Logstash 2.4.1), or must I have to use a ruby filter?

Many thanks,

(Magnus B├Ąck) #2

I don't think there's a way of doing this without a ruby filter.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.