1. OverviewFlume has the ability to modify/delete the event at run time, which is achieved through interceptors (interceptors). interceptors need to implement the Org.apache.flume.interceptor.Interceptor interface. interceptors can modify or delete events based on any criteria that the developer chooses in the selector. The Interceptor employs a chain of responsibility mode, and multiple interceptors can be intercepted in the specified order. the list of events returned by an interceptor is passed to the next interceptor in the chain. If an interceptor needs to delete an event, it simply needs to not include the event to be deleted in the returned event set. If you want to delete all events, simply return an empty list. 2.Timestamp InterceptorThis interceptor inserts the current processing time in milliseconds in the event header. the name of the header is timestamp, and the value is the timestamp of the current processing. If you have already had this timestamp before, keep the original timestamp. parameter Description:!type – type name, which must be the full path name of the timestamp or custom class preserveexisting False if the timestamp already exists whether it is preserved 3.Host InterceptorThis interceptor is inserted into the host name or IP of the current processing agentThe name of the header is host or configuredThe value is the host name or IP address, based on the configuration. parameter Description:!type – type name, must be host preserveexisting False if the host name already exists whether it is reserved Useip True if configured to True uses IP, configured to false with host name Hostheader The name used when the host joins the header 4.Static InterceptorThis interceptor allows the user to add static header information using static values to all events. specifying more than one header at a time is not allowed in the current implementation. If you need to add more static headers, you can specify more than one statics interceptorsProperty Description:!type – type, must be static preserveexisting True if the configuration header already exists whether it should be retained key key to increase the transparency Value value to increase the header value 5.UUID InterceptorThis interceptor adds a global consistency flag to all event headers. is actually the UUID. Property Description:!type – type name, must be Org.apache.flume.sink.solr.morphline.uuidinterceptor$builder headername ID header name preserveexisting True if the header already exists, whether to preserve prefix "" string prefix that is spliced before the UUID 6.Morphline Interceptor7.search and Replace InterceptorThis interceptor provides a simple string-based regular search and replace function. Property Description: Type – The name of the class, which must be "Search_replace" searchpattern – Regular expression to search for and replace replacestring – the string to be replaced with CharSet UTF-8 Character set encoding, default Utf-8 8.Regex Filtering InterceptorThis interceptor filters events by parsing an event body to match a given regular expression. The provided regular expression can be used to include or shaving events. Property Description:!type – type, must be set to Regex_filter regex ". *" to match the regular expression excludeevents False if true shaving matches the event, false contains the matching event. 9.Regex Extractor Interceptormatches the event with the specified regular expression and joins the matched group as a header into the event. It also supports a plug-in serializer used to format matching groups before joining them as a header. Property Description:!type – type, must be Regex_extractor !regex – Regular expression to match !serializers – space-separated List of serializers for mapping matches to header names and serializing their Values. (see example below) Flume provides built-in support for the following serializers: Org.apache.flume.interceptor.RegexExtractorInterceptorPassThroughSerializer Org.apache.flume.interceptor.RegexExtractorInterceptorMillisSerializer serializers.<s1>.type default must be default ( Org.apache.flume.interceptor.RegexExtractorInterceptorPassThroughSerializer), Org.apache.flume.interceptor.RegexExtractorInterceptorMillisSerializer, or the FQCN of a custom class that implements Org.apache.flume.interceptor.RegexExtractorInterceptorSerializer serializers.<s1>.name – serializers.* – serializer-specific properties ----If The Flume event body contained 1:2:3.4FOOBAR5 and the following configuration was used A1.sources.r1.interceptors.i1.regex = (\\d):(\\d):(\\d)a1.sources.r1.interceptors.i1.serializers = S1 s2 S3A1.sources.r1.interceptors.i1.serializers.s1.name = OneA1.sources.r1.interceptors.i1.serializers.s2.name =A1.sources.r1.interceptors.i1.serializers.s3.name = threeThe extracted event would contain the same body but the following headers would have been added one=>1, two=>2, t Hree=>3 ----
9.Interceptors-Interceptors
