Config very repetitive, possible to be more DRY?

Hi, I have noticed that logstash config appears to be very repetitive, for example we make use of "jdbc_streaming" filter 21 times. This result in having to define jdbc_user, jdbc_password, jdbc_driver_class, jdbc_driver_library, jdbc_connection_string 21 times over, despite being the same each time.

Is there some way to define a base block/macro/template, and then extend/modify it each time in use. i.e

template {
    name => "my_jdbc_streaming"
    jdbc_streaming {
        jdbc_user => "xxx"
        jdbc_password => "xxx"
        jdbc_driver_class => "Java::com.mysql.jdbc.Driver"
        jdbc_driver_library => "/usr/share/java/mysql-connector-java.jar"
        jdbc_connection_string => "xxx"
    }
}


filter {
    my_jdbc_streaming {
        statement => "yyy"
		parameters => { "yyy" => "yyy" }
        target => "yyy"
        add_field => { "yyy" => "yyy" }
        remove_field => ["yyy"]
    }
    my_jdbc_streaming {
        statement => "xxx"
		parameters => { "xxx" => "xxx" }
        target => "xxx"
        add_field => { "xxx" => "xxx" }
        remove_field => ["xxx"]
    }
}

While I am showing jdbc_streaming as an example, I am also interested in a general solution. Is there any way to create you own template filter or function (Without creating a full blown Java plugin).

On a side note, I assume there is no way do to a break or continue (so you can have multiple conf files, but ensure a conf file only works one type of event) i.e

filter {
	if [@metadata][component] != "component-x" {
		break
	}
	....
}

Im aware I could place the rest of the code (...) into the if statement and make it an equals comparison, however it would mean the code in the rest of the filter would "have" to be indented and I would prefer to avoid it. (This is a very minor issue, just wanted to gather any other solution). I attempted to use drop(), but that drops the event across all files (which I dont want).

Thank you,
Emmet

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.