Common filter code, called from another filter?

#1

I have 2 different filters that come in on different ports. Each one gets send several input types, 3 of these are common across the two files.

Current processing I have "if" blocks looking at tags, and then blocks of code for data manipulations. This code is obviously common across the two filters, which is wasteful. Is it possible to reference another filter file with just the code for that type, where both could call that file?

Thanks

(Charlie) #2

Can you share your config snippet?

I understand that you meant (simplified logic):
input {
tcp { port => 11, tag_11}
tcp { port => 12, tag_12}
}
filter {
if [tag] = "tag_11 { do_stuff_1}
if [tag] = "tag_12 {do_stuff_1}
}

And you want to take the do_stuff_1 to one place like a function and reference it within your if condition?

#3

If they are running in separate pipelines they can certainly both reference a common file amongst their configuration files.