question: will Logstash like filters be a feature?

[tsaikd]

question: will Logstash like filters be a feature?

[mirdhyn]

PR #12 is introducing filters! I only implemented add_field for now but more are coming!

[tsaikd]

I'm not sure what kind of filter is necessary when collecting log.
In my use case, ENV variable in output module is satisfied for me.
If you need to preprocess log, you can output to redis and intergrate with logstash.
And this project is welcome for PR.
No rule yet. I will review all PR.

[cleesmith]

This is a typical Logstash filter used for syslogs (mostly for the geolocation of an IP address):

filter {
      date {
        match => [ "timestamp", "ISO8601" ]
        target => "@timestamp"
      }

      if [client_ip] {
        geoip {
         source => "client_ip"
         add_tag => [ "geoip" ]
        }
      }

      if [timestamp] {
        ruby { code => "event['log_timestamp'] = event['@timestamp'].strftime('%Y-%m-%d')"}
      }
    }
  }
}

I thought gogstash was a replacement for Logstash?
Thanks.

[tsaikd]

It's hard to implement all logstash filters.
I will assess the geoip filter.

I hope gogstash can replace logstash :)
But it's easier to only ship log.

[cleesmith]

Understood, after all, Logstash has been around for many years.
There's also Filebeat for shipping logs in Go.
I recently created a new beat for shipping Snort/Suricata's alert+event+packet logs.
Elastic Beats are very new, but it is easy to create new ones using libbeat.

[vjeantet]

Hello

I wrote some basic logstash filters you may find there : https://github.com/veino/processors

[tsaikd]

seems no document? 😕

[vjeantet]

Hello @tsaikd, no documents as of today, i plan to document them on the coming weeks.

I put a link here to give inspiration and share my work. :)

I implemented a logstash clone with theses filters you may find here : https://github.com/vjeantet/logstack

I think the 2 projects could try to share the same "processors"/plugins what do you think ?

[tsaikd]

It looks like using the logstash config format?
Good idea, hope to see more documents and example.

[tsaikd]

some filters implemented, e.g. https://github.com/tsaikd/gogstash/tree/master/filter
check README for more information.