search

loggie-io / loggie

A lightweight, cloud-native data transfer agent and aggregator
https://loggie-io.github.io/docs-en/
Apache License 2.0
1.26k stars 167 forks source link

Need match function usage example for Interceptor.transformer #587

Closed jangrui closed 1 year ago

jangrui commented 1 year ago

How to modify the following configuration

    interceptors: |
      - type: transformer
        actions:
          - action: copy(fields.containername, server)
          - action: copy(fields.namespace, _)
          - action: regex(_)
            pattern: \S+-(?<env>\S+)-\S+
          - if: match(body, regex)
            # regex: (\S+) (\S+) (\S+) (\[.*?\]) \"(.*?) (.*?) (.*?)\" (\S+) (\S+) \"(.*?)\" \"(.*?)\" \"(.*?)\"
            regex: (?<ip>\S+) (?<id>\S+) (?<u>\S+) (?<timestamp>\[.*?\]) \"(?<request_method>.*?) (?<url>.*?) (?<http_version>.*?)\" (?<status>\S+) (?<size>\S+) \"(?<referer>.*?)\" \"(?<agent>.*?)\" \"(?<forwarded>.*?)\"
            then:
              - action: regex(body)
                pattern: (?<ip>\S+) (?<id>\S+) (?<u>\S+) (?<timestamp>\[.*?\]) \"(?<request_method>.*?) (?<url>.*?) (?<http_version>.*?)\" (?<status>\S+) (?<size>\S+) \"(?<referer>.*?)\" \"(?<agent>.*?)\" \"(?<forwarded>.*?)\"
              - action: copy(body, message)
            else:
              - action: move(body, message)
jangrui commented 1 year ago

Resolved

    interceptors: |
      - type: transformer
        actions:
          - action: copy(fields.containername, server)
          - action: copy(fields.namespace, _)
          - action: regex(_)
            pattern: \S+-(?<env>\S+)-\S+
          # access
          - if: match(body, (\S+) (\S+) (\S+) (\[.*?\]) \"(.*?) (.*?) (.*?)\" (\S+) (\S+) \"(.*?)\" \"(.*?)\" \"(.*?)\")
            then:
              - action: regex(body)
                pattern: (?<ip>\S+) (?<id>\S+) (?<u>\S+) (?<timestamp>\[.*?\]) \"(?<request_method>.*?) (?<url>.*?) (?<http_version>.*?)\" (?<status>\S+) (?<size>\S+) \"(?<referer>.*?)\" \"(?<agent>.*?)\" \"(?<forwarded>.*?)\"
              - action: move(body, message)
          # error
          - if: match(body, (.*?) (\[.*?\]) (.*)$)
            then:
              - action: regex(body)
                pattern: (?<timestamp>.*?) (?<level>\[.*?\]) (?<log>.*)$
              - action: move(body, message)
      - type: schema
        addMeta:
          timestamp:
            key: timestamp