代码之家  ›  专栏  ›  技术社区  ›  Brad Hein

什么是正确的方法传递一个数字变量到油门过滤器的最大年龄字段

  •  0
  • Brad Hein  · 技术社区  · 6 年前

    如何将整型字段传递给 max_age 节流过滤器块参数?我无法克服下面显示的错误。

    [ERROR] 2019-02-18 20:19:30.005 [Converge PipelineAction::Create<main>] throttle - Invalid setting for throttle filter plugin:
    
      filter {
        throttle {
          # This setting must be a number
          # Expected number, got "throttle_max_age" (type throttle_max_age)
          max_age => ["throttle_max_age"]
          ...
        }
      }
    

    logstash配置的过滤器部分:

    filter {
    
        mutate { add_field => { "eventkey" => "%{[logger][hostname]}-%{[probe][name]}-%{voltage_category}" } }
    
        # Specific alert frequencies for different alert categories
        if ["voltage_category] == "normal" {
            # Voltage normal
            # 86400 = one day
            mutate { add_field => { "throttle_period" => 86400 }  }
            # Two days and ten seconds
            mutate { add_field => { "throttle_max_age" => 172810 } }
        } else {
            # Abnormal event. Throttle less, so more notifications are transmitted
            mutate { add_field => { "throttle_period" => 15 } }
            mutate { add_field => { "throttle_max_age" => 180 } }
        } # end of voltage abnormal
    
        # Added this for S & G - had no effect. 
        mutate { convert => { "throttle_max_age" => "integer" } }
    
        # For a given ID, emit ONE event no more than every 15 seconds
        # ID: logger.hostname + probe.name
        throttle {
            key => "%{eventkey}"
            period => [throttle_period]
            max_age => [throttle_max_age]
            before_count => -1
            after_count => 1
            add_tag => "throttled"
        }
    }
    
    0 回复  |  直到 6 年前
        1
  •  2
  •   mihomir    6 年前

    不幸的是,现在似乎不可能做到这一点,因为值在加载Logstash配置时被验证,并且它期望一个具体的数字值。

    下面是throttle插件的源代码,它在其中检查值是否为数字:
    https://github.com/logstash-plugins/logstash-filter-throttle/blob/master/lib/logstash/filters/throttle.rb#L191
    与允许字段替换的周期值比较:
    https://github.com/logstash-plugins/logstash-filter-throttle/blob/5c8d3543ba0eed9ba8a93ae4ffbef7fb15d881ea/lib/logstash/filters/throttle.rb#L197

    作为一种解决办法,如果您只有几个案例的最大年龄值,您可以修改条件,并在那里放置两个节流过滤器。例如:

    # Specific alert frequencies for different alert categories
    if ["voltage_category] == "normal" {
        # Voltage normal
        throttle {
            key => "%{eventkey}"
            # 86400 = one day
            period => 86400
            # Two days and ten seconds
            max_age => 172810
            before_count => -1
            after_count => 1
            add_tag => "throttled"
        }
    } else {
        # Abnormal event. Throttle less, so more notifications are transmitted
        throttle {
            key => "%{eventkey}"
            period => 15
            max_age => 180
            before_count => -1
            after_count => 1
            add_tag => "throttled"
        }
        # end of voltage abnormal
    }