Class: LogStash::Outputs::ElasticsearchGroom

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/outputs/elasticsearch_groom.rb

Overview

This output grooms the indices created by the ‘elasticsearch` output plugin. By leveraging the same timestamp-based `index` specification, this plugin closes or deletes indices that are older than a configured cutoff.

The actions of this plugin are event-driven, meaning it only evaluates and grooms indices when an event is received. Combined with the ‘logstash-input-heartbeat` plugin, there is some interesting configurations you can setup such as:

source

input {

heartbeat {
  type => 'groom'
  interval => 86400
  add_field => {
    scope => 'open'
    cutoff => '2w'
    action => 'close'
  }
}

heartbeat {
  type => 'groom'
  interval => 86400
  add_field => {
    scope => 'closed'
    cutoff => '4w'
    action => 'delete'
  }
}

}

output 

if [type] == 'groom' {
  elasticsearch_groom {
     host => 'localhost:9200'
     index => 'logstash-%{+YYYY.MM.dd'
     scope => '%scope'
     age_cutoff => '%cutoff'
     action => '%action'
  }
}

}

Instance Method Summary collapse

Instance Method Details

#receive(event) ⇒ Object 



105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
 
# File 'lib/logstash/outputs/elasticsearch_groom.rb', line 105

def receive(event)
  return unless output?(event)

  ts_wildcarded = @index.gsub /%{\+[^}]+}/, '*'
  ts_wildcarded = event.sprintf ts_wildcarded

  resolved_scope = event.sprintf(@scope)
  return unless valid_option? 'scope', resolved_scope, %w(open closed both)

  candidates = @es_access.matching_indices ts_wildcarded, resolved_scope
  @logger.debug? and @logger.debug "Starting with #{candidates}"

  groomed = []
  if (ts_bit_matched = @index.match /%{\+([^}]+)}/)
    groomed = groom_by_time(event, candidates, ts_bit_matched)
  else
    @logger.warn "Only 'index' with a timestamp placeholder is supported. Instead had #{resolvedIndex}"
  end

  # We consumed it, so cancel it
  event.cancel if @cancel_when_used

  "Groomed #{groomed}"
end

#register ⇒ Object

Raises:

  • (LogStash::ConfigurationError) 


85
86
87
88
89
90
91
92
93
 
# File 'lib/logstash/outputs/elasticsearch_groom.rb', line 85

def register
  options = {
      host: @host
  }
  @es_access = create_es_accessor(options)

  raise LogStash::ConfigurationError, "A timestamp placeholder %{+___} is required in the 'index' config of elasticsearch_groom" \
     unless @index.match /%{\+(.+)}/
end