Global variables in an external file

Elastic Stack Logstash
1

Hi guys,
I would like logstash to use global variables defined in an external file and use them in each event elaboration for doing something like this:

external file:
field1 = [value1,value2]

meta logstash Language:

if the_value_of_an_event_field in field1
drop event

Moreover I would like my solution to be dynamic so, for example, I can extend field 1 to [value1, value2, value3] without stopping logstash and so on..

I tried different solutions (like reading external file via filebeat or via logstash input file, but they, of course, read it one time only; using grok and external path pattern but that's not working cause I don't want to match patterns..).

Any help or suggestion will be appreciated.
Thank you guys.

Andrea

2

Have you looked at the translate filter?

3

I solved using Ruby plugin, reading Values from file and saving them inside an array. Of course, this operation will be performed every time, but this will let pipeline to dynamic change read Values.

ruby {
	code => "messaggio = ''
			 array = File.open('/home/elastic/Elastic/configurations/whitelist.txt').readlines.map(&:strip).each do |line| messaggio << line end				 
			 event.set('[white_list]', array)
			 "		 
}

Thank you for your suggestions, anyway :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.