The Modify Filter plugin allows you to change records using rules and conditions.
As an example using JSON notation to,
Rename Key2
to RenamedKey
Add a key OtherKey
with value Value3
if OtherKey
does not yet exist
Example (input)
Example (output)
The plugin supports the following rules:
Rules are case insensitive, parameters are not
Any number of rules can be set in a filter instance.
Rules are applied in the order they appear, with each rule operating on the result of the previous rule.
The plugin supports the following conditions:
Conditions are case insensitive, parameters are not
Any number of conditions can be set.
Conditions apply to the whole filter instance and all its rules. Not to individual rules.
All conditions have to be true
for the rules to be applied.
You can set Record Accessor as STRING:KEY
for nested key.
In order to start filtering records, you can run the filter from the command line or through the configuration file. The following invokes the Memory Usage Input Plugin, which outputs the following (example),
Note: Using the command line mode requires quotes parse the wildcard properly. The use of a configuration file is recommended.
The output of both the command line and configuration invocations should be identical and result in the following output.
Operation | Parameter 1 | Parameter 2 | Description |
---|---|---|---|
Condition | Parameter | Parameter 2 | Description |
---|---|---|---|
Set
STRING:KEY
STRING:VALUE
Add a key/value pair with key KEY
and value VALUE
. If KEY
already exists, this field is overwritten
Add
STRING:KEY
STRING:VALUE
Add a key/value pair with key KEY
and value VALUE
if KEY
does not exist
Remove
STRING:KEY
NONE
Remove a key/value pair with key KEY
if it exists
Remove_wildcard
WILDCARD:KEY
NONE
Remove all key/value pairs with key matching wildcard KEY
Remove_regex
REGEXP:KEY
NONE
Remove all key/value pairs with key matching regexp KEY
Rename
STRING:KEY
STRING:RENAMED_KEY
Rename a key/value pair with key KEY
to RENAMED_KEY
if KEY
exists AND RENAMED_KEY
does not exist
Hard_rename
STRING:KEY
STRING:RENAMED_KEY
Rename a key/value pair with key KEY
to RENAMED_KEY
if KEY
exists. If RENAMED_KEY
already exists, this field is overwritten
Copy
STRING:KEY
STRING:COPIED_KEY
Copy a key/value pair with key KEY
to COPIED_KEY
if KEY
exists AND COPIED_KEY
does not exist
Hard_copy
STRING:KEY
STRING:COPIED_KEY
Copy a key/value pair with key KEY
to COPIED_KEY
if KEY
exists. If COPIED_KEY
already exists, this field is overwritten
Key_exists
STRING:KEY
NONE
Is true
if KEY
exists
Key_does_not_exist
STRING:KEY
NONE
Is true
if KEY
does not exist
A_key_matches
REGEXP:KEY
NONE
Is true
if a key matches regex KEY
No_key_matches
REGEXP:KEY
NONE
Is true
if no key matches regex KEY
Key_value_equals
STRING:KEY
STRING:VALUE
Is true
if KEY
exists and its value is VALUE
Key_value_does_not_equal
STRING:KEY
STRING:VALUE
Is true
if KEY
exists and its value is not VALUE
Key_value_matches
STRING:KEY
REGEXP:VALUE
Is true
if key KEY
exists and its value matches VALUE
Key_value_does_not_match
STRING:KEY
REGEXP:VALUE
Is true
if key KEY
exists and its value does not match VALUE
Matching_keys_have_matching_values
REGEXP:KEY
REGEXP:VALUE
Is true
if all keys matching KEY
have values that match VALUE
Matching_keys_do_not_have_matching_values
REGEXP:KEY
REGEXP:VALUE
Is true
if all keys matching KEY
have values that do not match VALUE