如何将整数字段传递给油门过滤器块的max_age
参数?我无法通过下面显示的错误。
[ERROR] 2019-02-18 20:19:30.005 [Converge PipelineAction::Create<main>] throttle - Invalid setting for throttle filter plugin:
filter {
throttle {
# This setting must be a number
# Expected number, got "throttle_max_age" (type throttle_max_age)
max_age => ["throttle_max_age"]
...
}
}
我的logstash配置的过滤器部分:
filter {
mutate { add_field => { "eventkey" => "%{[logger][hostname]}-%{[probe][name]}-%{voltage_category}" } }
# Specific alert frequencies for different alert categories
if ["voltage_category] == "normal" {
# Voltage normal
# 86400 = one day
mutate { add_field => { "throttle_period" => 86400 } }
# Two days and ten seconds
mutate { add_field => { "throttle_max_age" => 172810 } }
} else {
# Abnormal event. Throttle less, so more notifications are transmitted
mutate { add_field => { "throttle_period" => 15 } }
mutate { add_field => { "throttle_max_age" => 180 } }
} # end of voltage abnormal
# Added this for S & G - had no effect.
mutate { convert => { "throttle_max_age" => "integer" } }
# For a given ID, emit ONE event no more than every 15 seconds
# ID: logger.hostname + probe.name
throttle {
key => "%{eventkey}"
period => [throttle_period]
max_age => [throttle_max_age]
before_count => -1
after_count => 1
add_tag => "throttled"
}
}
不幸的是,目前似乎不可能这样做,因为在加载Logstash配置时验证该值并且它需要具体的数字值。
这是限制插件的源代码,它检查值是否为数字: https://github.com/logstash-plugins/logstash-filter-throttle/blob/master/lib/logstash/filters/throttle.rb#L191 与允许字段替换的周期值进行比较: https://github.com/logstash-plugins/logstash-filter-throttle/blob/5c8d3543ba0eed9ba8a93ae4ffbef7fb15d881ea/lib/logstash/filters/throttle.rb#L197
作为解决方法,如果你只有几个max_age值的情况,你可以修改条件并在那里放两个油门过滤器。例如:
# Specific alert frequencies for different alert categories
if ["voltage_category] == "normal" {
# Voltage normal
throttle {
key => "%{eventkey}"
# 86400 = one day
period => 86400
# Two days and ten seconds
max_age => 172810
before_count => -1
after_count => 1
add_tag => "throttled"
}
} else {
# Abnormal event. Throttle less, so more notifications are transmitted
throttle {
key => "%{eventkey}"
period => 15
max_age => 180
before_count => -1
after_count => 1
add_tag => "throttled"
}
# end of voltage abnormal
}