Refactoring logstash config

Elastic Stack Logstash
1

Being a OO developer and focusing on code maintainability and quality, I want to know is there way I can make my logstash config a bit nicer. For instance below is my config file and I hate to see those if statements. Also would be great if I can uses key-value dictionary for these if statements, use constants etc.

filter
{
if [machine]=="machineNameA"
{
mutate{
add_field => ["ServerName","dev-alias-01"]
}
}
if [machine]=="machineNameB"
{
mutate{
add_field => ["ServerName","dev-alias-02"]
}
}
if [machine]=="machineNameC"
{
mutate{
add_field => ["ServerName","QA-alias-01"]
}
}
if [machine]=="machineNameD"
{
mutate{
add_field => ["ServerName","QA-alias-02"]
}
}
if [machine]=="machineNameE"
{
mutate{
add_field => ["ServerName","UAT-alias-01"]
}
}
if [machine]=="machineNameF"
{
mutate{
add_field => ["ServerName","UAT-alias-02]
}
}
}

2

I too have similar question..

3

A very quick and easy alternative would be using the translate filter, like so

filter { translate { field => "machine" exact => true dictionary_path => "/path/to/file.yml" destination => "ServerName" } }

With a yaml file similar to below

"machineNameA": "dev-alias-01"
"machineNameB": "dev-alias-02"

Then you'd only need to maintain the external yaml file if it needs to be changed.

Edit: You can also use an inline kv pair inside the translate filter, but that a) looks bloated the higher the kv amount, and b) is not as easily maintainable as you'd need to alter the configuration itself and not plainly refresh an external file.

5

This sounds helpful. It would at least replace the nasty if statement.
Thanks!

6

Hi any more ideas for this. I am facing 2 issues here

  1. Logstash gives error plugin "filter" not available.
  2. When I try to download that using-plugin install logstash-filter-translate, I get error "connection refused". I think this is happening because my server is behind a proxy. There is no simple process for me to bypass all this or get this installed.
7

When I try to download that using-plugin install logstash-filter-translate, I get error "connection refused". I think this is happening because my server is behind a proxy. There is no simple process for me to bypass all this or get this installed.

8

Thanks I will try this and keep you posted.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.