<div id="readability-page-1" class="page"><div id="post-body-1406692707397421592" itemprop="articleBody">
캡쳐그룹 순서번호는 1부터 시작한다.<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGl-5aMV8phuQR0YOOViJkCOnonbpTk6NzLnrtM_5H-P1k-9IxU-w1atWtv20yMfM1L2FjEX0kFuBFaM9R_PlFvpYDnBlV2xe24avBHbE65D_4iizpQQTPEDsVz7ewR2f_XtRi-t6J7I7sAASiWydMfrl7vpO-BsQco4oPrAHoeQxcQbyIc_W_yoUvuvaH/s2027/captures.png"><img data-original-height="988" data-original-width="2027" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGl-5aMV8phuQR0YOOViJkCOnonbpTk6NzLnrtM_5H-P1k-9IxU-w1atWtv20yMfM1L2FjEX0kFuBFaM9R_PlFvpYDnBlV2xe24avBHbE65D_4iizpQQTPEDsVz7ewR2f_XtRi-t6J7I7sAASiWydMfrl7vpO-BsQco4oPrAHoeQxcQbyIc_W_yoUvuvaH/s16000/captures.png"></a><a name="more"></a>첫 번째 순서번호 캡쳐를 위한 ruby 필터
<div><pre><code>ruby {&nbsp;code =&gt; "&nbsp; event.set('result', event.get('message').match(/(.).../).captures[1])	&nbsp;"}</code></pre></div>
캡쳐 실패.
<div><pre><code>[2025-01-18T20:37:14,434][INFO ][logstash.agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}{&nbsp; &nbsp; "message" =&gt; "abcd\r",&nbsp; &nbsp; &nbsp;"result" =&gt; nil}</code></pre></div>

왜 안 되지? 전체 문자를 개별 캡쳐해봤다.
<div><pre><code>ruby {&nbsp;code =&gt; "&nbsp; event.set('result', event.get('message').match(/(.)(.)(.)(.)/).captures[1])	&nbsp;"}</code></pre></div>

두 번째 순서번호를 가져오네?
<div><pre><code>[2025-01-18T20:32:47,467][INFO ][logstash.agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}{&nbsp; &nbsp; "message" =&gt; "abcd\r",&nbsp; &nbsp; &nbsp;"result" =&gt; "b"}</code></pre></div>

순서번호를 빼봤다.
<div><pre><code>ruby {&nbsp;code =&gt; "&nbsp; event.set('result', event.get('message').match(/(.)(.)(.)(.)/).captures)	&nbsp;"}</code></pre></div>
<div><pre><code>[2025-01-18T20:33:35,432][INFO ][logstash.agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}{&nbsp; &nbsp; "message" =&gt; "abcd\r",&nbsp; &nbsp; &nbsp;"result" =&gt; [&nbsp; &nbsp; &nbsp; &nbsp; [0] "a",&nbsp; &nbsp; &nbsp; &nbsp; [1] "b",&nbsp; &nbsp; &nbsp; &nbsp; [2] "c",&nbsp; &nbsp; &nbsp; &nbsp; [3] "d"&nbsp; &nbsp; ]}</code></pre></div>
순서번호가 0부터 시작(..)<div>관련&nbsp;글<ul><li><a href="https://kangmyounghun.blogspot.com/2025/01/logstash-ruby-5th.html">Logstash 필터 ruby - 5th</a></li><li><a href="http://kangmyounghun.blogspot.kr/2017/10/logstash-ruby.html" target="">Logstash 필터 ruby</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/06/elasticsearch-grok.html" target="_blank">Logstash 필터 grok</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/07/logstash-mutate.html" target="_blank">Logstash 필터 mutate</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/02/logstash-geoip.html" target="_blank">Logstash 필터&nbsp;geoip</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/04/logstash-dissect.html" target="_blank">Logstash 필터 dissect</a></li><li><a href="http://kangmyounghun.blogspot.com/2018/09/logstash-kv.html" target="_blank">Logstash 필터&nbsp;kv</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/01/logstash-date.html" target="_blank">Logstash 필터 date</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/02/logstash-translate.html" target="_blank">Logstash 필터 translate</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/08/logstash-drop.html" target="_blank">Logstash 필터 drop</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/11/logstash-useragent.html" target="_blank">Logstash 필터 useragent</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-elapsed.html" target="_blank">Logstash 필터 elapsed</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/04/logstash-fingerprint.html" target="_blank">Logstash 필터 fingerprint</a></li><li><a href="https://kangmyounghun.blogspot.com/2022/12/logstash-csv.html" target="_blank">Logstash 필터 csv</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/11/logstash-dns.html">Logstash 필터 dns</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/01/logstash-split.html">Logstash 필터 split</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-codec-multiline.html" target="_blank">Logstash codec 플러그인 multiline</a></li></ul></div>

</div></div>

케세라세라

캡쳐그룹 순서번호는 1부터 시작한다.
첫 번째 순서번호 캡쳐를 위한 ruby 필터
ruby {
 code => "
  event.set('result', event.get('message').match(/(.).../).captures[1])	
 "
}
캡쳐 실패.
[2025-01-18T20:37:14,434][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "message" => "abcd\r",
     "result" => nil
}
왜 안 되지? 전체 문자를 개별 캡쳐해봤다.
ruby {
 code => "
  event.set('result', event.get('message').match(/(.)(.)(.)(.)/).captures[1])	
 "
}
두 번째 순서번호를 가져오네?
[2025-01-18T20:32:47,467][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "message" => "abcd\r",
     "result" => "b"
}
순서번호를 빼봤다.
ruby {
 code => "
  event.set('result', event.get('message').match(/(.)(.)(.)(.)/).captures)	
 "
}
[2025-01-18T20:33:35,432][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "message" => "abcd\r",
     "result" => [
        [0] "a",
        [1] "b",
        [2] "c",
        [3] "d"
    ]
}
순서번호가 0부터 시작(..)
관련 글
Logstash 필터 ruby - 5th
Logstash 필터 ruby
Logstash 필터 grok
Logstash 필터 mutate
Logstash 필터 geoip
Logstash 필터 dissect
Logstash 필터 kv
Logstash 필터 date
Logstash 필터 translate
Logstash 필터 drop
Logstash 필터 useragent
Logstash 필터 elapsed
Logstash 필터 fingerprint
Logstash 필터 csv
Logstash 필터 dns
Logstash 필터 split
Logstash codec 플러그인 multiline

Logstash 필터 ruby - 6th

댓글