Hi, I am using Logstash to parse and enter graphite metrics into InfluxDB. However, I wanted to create a large dictionary source where it can match certain metric lines based on their pattern and reorganize the string based on the delimiter - "."
I know the translate filter can do this, also it can be done via mutate and gsub. I could not find documentation on how to use the regex to create capture groups and place them in the resultant string. Example:
I would like the above two to be reorganized to: timer.CMTopology.job.cm_attributes.processor.DiscoveryResponse.succeeded timer.CMHierarchy.job.cm_equalization.processor.ExplorerResponse.succeeded
Notice that the fields are slightly swapped around, that's all. Would I be able to do this through some kind of capture group in translate (note the $1,2,3,4 are the captured groups)?
That is what I figured, unfortunately. I suppose mutate+gsub would give me the best results for what I need, and I'm sure I can definitely similarly to the translate array of regex patterns but not from an external file, just a reaaaally long list in the actual filter. Thanks! I'll see if anyone has any secret/hidden input.
Note that the code for mutate+gsub is right there on github. You could repurpose it.
Use a ruby filter. In the init section read in a file and populate an array with fieldname / pattern / replacement triplets, like @gsub. Then run the section of code from the register function that generates @gsub_parsed.
In the code option run the code from the gsub function of a mutate filter.
Yeah that sounds like a good idea. Assuming my list of replacements isn't too long I will repurpose this and outsource the replacement hash to another file. Thanks again.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.