Setup a filters/format or something similar as a directory. In there, put files that are the --filter snippets. This way, someone can specify on the command line:
~$ snippet parse my.log --do combined-apache-log
Where their filter resides in:
snippet-cli
|- do
|- combined-apache-log
And snippet-cli/do/combined-apache-log contents are partial Logstash filter specifications (they will be surrounded by filter { ... }:
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
Alternatively, instead of an option, perhaps require a positional argument instead (and rename the directory to snippet-cli/format:
~$ snippet parse combined-apache-log my.log
Could even do tab autocompletion based on the file names present in format directory.
Setup a
filters
/format
or something similar as a directory. In there, put files that are the--filter
snippets. This way, someone can specify on the command line:Where their filter resides in:
And
snippet-cli/do/combined-apache-log
contents are partial Logstash filter specifications (they will be surrounded byfilter { ... }
:Alternatively, instead of an option, perhaps require a positional argument instead (and rename the directory to
snippet-cli/format
:Could even do tab autocompletion based on the file names present in
format
directory.