Class: LogStash::Outputs::Exec

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/outputs/exec.rb

Overview

The exec output will run a command for each event received. Ruby’s ‘system()` function will be used, i.e. the command string will be passed to a shell. You can use `%name` and other dynamic strings in the command to pass select fields from the event to the child process. Example:

source,ruby

output 

if [type] == "abuse" {
  exec {
    command => "iptables -A INPUT -s %{clientip -j DROP"
  }
}

}

WARNING: If you want it non-blocking you should use ‘&` or `dtach` or other such techniques. There is no timeout for the commands being run so misbehaving commands could otherwise stall the Logstash pipeline indefinitely.

WARNING: Exercise great caution with ‘%{name}` field placeholders. The contents of the field will be included verbatim without any sanitization, i.e. any shell metacharacters from the field values will be passed straight to the shell.

Instance Method Summary collapse

Instance Method Details

#receive(event) ⇒ Object 



43
44
45
46
47
 
# File 'lib/logstash/outputs/exec.rb', line 43

def receive(event)
  
  @logger.debug("running exec command", :command => event.sprintf(@command))
  system(event.sprintf(@command))
end

#register ⇒ Object 



38
39
40
 
# File 'lib/logstash/outputs/exec.rb', line 38

def register
  @logger.debug("exec output registered", :config => @config)
end