有条件地构建logstash配置的输出块

时间:2017-10-03 15:49:12

标签: elasticsearch output logstash conditional-statements

我的logstash配置中有一个输出块,如下所示:

output {
  elasticsearch {
    hosts => ["elasticsearch.app:9200"]
    healthcheck_path => "/"
    flush_size => "500"
    user => "user"
    password => "password"
    index => "%{[@metadata][index]}"
    document_id => "%{[@metadata][id]}"
    document_type => "%{[@metadata][type]}"
    routing => "%{[@metadata][routing]}"
    action => "%{[@metadata][action]}"
    version => "%{[@metadata][version]}"
  }
}

有时,要转向elasticsearch的索引项具有父级。如果我将一个父字段添加到我的配置elasticsearch,那么期望索引映射声明_parent。并非所有索引都可以。有没有更简洁的方法处理这个而不是使用IF块,并在条件的两侧几乎相同的配置?

像这样:

output {  
  if [@metadata][parent] {
    elasticsearch {
      hosts => ["elasticsearch.app:9200"]
      healthcheck_path => "/"
      flush_size => "500"
      user => "user"
      password => "password"
      index => "%{[@metadata][index]}"
      document_id => "%{[@metadata][id]}"
      document_type => "%{[@metadata][type]}"
      routing => "%{[@metadata][routing]}"
      action => "%{[@metadata][action]}"
      version => "%{[@metadata][version]}"
      parent => "%{[@metadata][parent]}"
    }
  } else {
    elasticsearch {
      hosts => ["elasticsearch.app:9200"]
      healthcheck_path => "/"
      flush_size => "500"
      user => "user"
      password => "password"
      index => "%{[@metadata][index]}"
      document_id => "%{[@metadata][id]}"
      document_type => "%{[@metadata][type]}"
      routing => "%{[@metadata][routing]}"
      action => "%{[@metadata][action]}"
      version => "%{[@metadata][version]}"
    }
  }  
}

不是我最喜欢的解决方案。

0 个答案:

没有答案