flume-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Balthasar Schopman <b.schop...@tech.leaseweb.com>
Subject Add hostname to event body
Date Tue, 18 Aug 2015 15:05:28 GMT

We're setting up Flume to monitor the access logs of our web servers. Flume reads the access
logs, but it must also manipulate it. It must add the hostname and a delimiter char to the
start of every line. We're trying to accomplish this using Interceptors [1].

We're able to put any constant string at the start of a line by using the search/replace interceptor.
But how do we make this the hostname? We've tried using the hostname interceptor, but that
only adds the hostname to the header. Also tried using a variable `%{host}` or  `%{hostname}`,
but that isn't replaced by the actual hostname.

agent.sources.src.interceptors = host replacer
agent.sources.src.interceptors.host.type = host
agent.sources.src.interceptors.replacer.type = search_replace
agent.sources.src.interceptors.replacer.searchPattern = ^
agent.sources.src.interceptors.replacer.replaceString = %{host}

Any help would be appreciated. If the goal can be achieved in a completely different way,
please let us know.

[1] http://flume.apache.org/FlumeUserGuide.html#flume-interceptors

Kind regards,
Balthasar Schopman
LeaseWeb CDN Innovation Engineer

Kind regards,

Balthasar Schopman
Software Developer
LeaseWeb Technologies B.V.

T: +31 20 316 0232
E: b.schopman@tech.leaseweb.com
W: http://www.leaseweb.com

Luttenbergweg 8, 1101 EC Amsterdam, Netherlands

View raw message