多个Filters不生效

[zimu312500]

按以下配置测试一下并给出结果

inputs:
- Stdin: {}
filters:
- XXX
outputs:
- Stdout: {}

• 源数据

• 配置文件 inputs:

  • Kafka: topic: cloud.log.app: 3 codec: json consumer_settings: bootstrap.servers: ":9092" group.id: gohangout max.partition.fetch.bytes: '104857600' auto.commit.interval.ms: '3000' from.beginning: 'false' messages_queue_length: 100 Filters: if:
  • '!EQ($.kubernetes.container.name,"controller")' filters:
    • Add: fields: a: 'xyZ'

  outputs:

  • Elasticsearch: hosts:
    • 'http://:9200' index: '%{kubernetes}{container}{name}-%{+2006.01.02}.gohangout' index_time_location: 'Local' template_name: gohangout-log index_type: "logs" bulk_actions: 5000 bulk_size: 20 flush_interval: 30 concurrent: 3 compress: false es_version: 7 retry_response_code: [401, 502]

• 输出

• 期望 在这条日志中增加一个字段，但是不生效。本意是想通过if条件来区分处理的filters，避免每个filters中都要判断，如 inputs:

• Stdin: {}

• Filters: if:

  • '!EQ($.kubernetes.container.name,"controller")' filters:
    • Add: fields: a: 'xyZ' if:
  • 'EQ($.kubernetes.container.name,"controller")' filters:
    • Add: fields: abc: 'xyZ' outputs:

• Stdout: {}

[zimu312500]

类似于这个，但是没有生效

[zimu312500]

应该是这样的格式。。。。 inputs: filters:

• Filters: if:
  • '!EQ($.kubernetes.container.name,"controller")' filters:
  • Grok: src: message match: outputs: Stdout: {}