Global variable?

[Chemse (Taloub)]

Hello,

Since logstash deals with a log file line by line, I have a field just in the begining of the file, I want to use it value as a condition for the rest of the file. Is there a method to do it ? Make this variable available in all the process ??

Help !!!!

[Chemse (Taloub)]

I’ve tried this code but it doesn’t work

date {
        match => ["period1","dd/MM/YYYY"]
        target=> "period1"
    }
    date {
        match => ["period2","dd/MM/YYYY"]
        target=> "period2"
   }
   ruby {
        code => "event.set('period', (event.get('period2') - event.get('period1'))/3600/24)"

   }
   ruby{
               code => "$my_var " = "%{peroid}" 
       }

I want to use the value of $my_var as a condition for an other event (next line)

[Chemse (Taloub)]

Help please !!!

[theuntergeek (Aaron Mildenstein)]

Logstash is a streaming processor. There is no way for it to keep state on a line from the beginning of a file using only the ruby filter.

You may wonder why this is so. The answer is particularly that Logstash isn't programmed to know if it's going to only ever ready one file. It's designed to keep reading from new files in a location, even if you specify a single-named file. What if that file keeps the same name, but is rotated by some other process? Logstash can't know that. As a result, there's simply no way using the file input plugin to read headers from the first line of a file and keep them for use later on in the stream.

There have been some efforts made by some users to write a csv input plugin to accomplish this, as csv files frequently have a header line for this same purpose. I'm not sure where those efforts are hosted, or if you can find them. My point is that what you're seeking requires a dedicated input plugin, and cannot be otherwise accomplished using the ruby filter.