Types in Logstash

Types in Logstash

• Array
• Boolean
• bytes
• Codec
• Hash
• Number
• Password
• Path
• String

Array

An array can is a single string value or multiple values. If you specify the same setting multiple times, it appends to the array.
Example

"/var/log/messages""/var/log/*.log""/data/mysql/mysql.log"

Boolean

Bull, True,false.
Example

true

bytes

A bytes field is a string field, that represents a valid unit of bytes. It is a convenient-to-declare specific sizes in your plugin options. Both SI (k M G T P E Z Y) and Binary (Ki Mi Gi Ti Pi Ei Zi Yi) units is supported. Binary units is in base-1024 and SI units is in base-1000.

Codec

Specify the format of the input and output
A codec is the name of Logstash codec used to represent the data. Codecs can used in both inputs and outputs.

Input codecs provide a convenient to decode your data before it enters the input. Output codecs provide a convenient to encode your data before it leaves the output. Using a input or output codec eliminates the need for a separate filter in your Logstash pipeline.

Example:

"json"

Hash

A hash is a collection of key value pairs specified in the format "field1" and "value1".
Hash, key-value pairs, enclosed in quotation marks.
Example

match => {  "field1""value1"  "field2""value2"  ...}

Password

A password is a string with a single value, which is not logged or printed.
is similar to string and will not be output.
Example:

"password"

Number

Numbers must is valid numeric values (floating point or integer).
Example

"password"

Path

A path is a string that represents a valid operating system path.
is the system path

astringasystem path.

String

A string must is a single character sequence. Note that string values is enclosed in quotes.
string, and quotation marks on the line.

"Hello world"

Specific can be seen in the original: http://www.elastic.co/guide/en/logstash/current/configuration.html

Familiarity with these types is a good understanding of other modules.
For example, Grok's Add_field, need hash type parameter, that is the following format

filter {  grok {    "foo_%{somefield}""Hello world, from %{host}" }  }}

Postscript

Logstash is a very good project, full documentation, and video, worth learning.

Types in Logstash