The plugin supports the following configuration parameters:
Getting Started
In order to start filtering records, you can run the filter from the command line or through the configuration file. The following invokes the Memory Usage Input Plugin, which outputs the following (example),
Note: Using the command line mode requires quotes parse the wildcard properly. The use of a configuration file is recommended.
The following command will load the mem plugin. Then the nest filter will match the wildcard rule to the keys and nest the keys matching Mem.* under the new key NEST.
[INPUT] Name mem Tag mem.local[OUTPUT] Name stdout Match *[FILTER] Name nest Match * Operation nest Wildcard Mem.* Nest_under Memstats Remove_prefix Mem.
This example nests all Mem.* and Swap,* items under the Stats key and then reverses these actions with a lift operation. The output appears unchanged.
Configuration File
[INPUT] Name mem Tag mem.local[OUTPUT] Name stdout Match *[FILTER] Name nest Match * Operation nest Wildcard Mem.* Wildcard Swap.* Nest_under Stats Add_prefix NESTED[FILTER] Name nest Match * Operation lift Nested_under Stats Remove_prefix NESTED
This example takes the keys starting with Mem.* and nests them under LAYER1, which itself is then nested under LAYER2, which is nested under LAYER3.
Configuration File
[INPUT] Name mem Tag mem.local[OUTPUT] Name stdout Match *[FILTER] Name nest Match * Operation nest Wildcard Mem.* Nest_under LAYER1[FILTER] Name nest Match * Operation nest Wildcard LAYER1* Nest_under LAYER2[FILTER] Name nest Match * Operation nest Wildcard LAYER2* Nest_under LAYER3
Example #4 - multiple nest and lift filters with prefix
This example starts with the 3-level deep nesting of Example 2 and applies the lift filter three times to reverse the operations. The end result is that all records are at the top level, without nesting, again. One prefix is added for each level that is lifted.
Configuration file
[INPUT] Name mem Tag mem.local[OUTPUT] Name stdout Match *[FILTER] Name nest Match * Operation nest Wildcard Mem.* Nest_under LAYER1[FILTER] Name nest Match * Operation nest Wildcard LAYER1* Nest_under LAYER2[FILTER] Name nest Match * Operation nest Wildcard LAYER2* Nest_under LAYER3[FILTER] Name nest Match * Operation lift Nested_under LAYER3 Add_prefix Lifted3_[FILTER] Name nest Match * Operation lift Nested_under Lifted3_LAYER2 Add_prefix Lifted3_Lifted2_[FILTER] Name nest Match * Operation lift Nested_under Lifted3_Lifted2_LAYER1 Add_prefix Lifted3_Lifted2_Lifted1_