CODEWITHSUNDEEP
logstashlogstash-configuration
Shivkumar Mallesappa
Shivkumar Mallesappa

Reputation: 3077

Logstash getting values for key from redis

Is it possible to get value for a key from redis using logstash in the filter section

For example

I have a log file which contains user name. In the filter section of logstash I am able to parse my log event and extract username from it

Now I also have a redis server which holds user role in key value format where my username is the key and role is the value

Is it possible to use logstash to connect to redis and get the associated role for a user in the filter section of logstash. Since on the basis of role I have to do other transformations

Basically I want to fire get command from logstash for redis.

Example configuration:

input {
  file {
    path => "/var/log/http.log"
  }
}
filter {
  grok {
    match => { "message" => "%{IP:client} %{WORD:username} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
  }

  //REDIS GET

  redis{

    //here I want to fire get redis command
    //Example :

    get => username
    target =>user_role
  }
}

output{

}

I hope I am clear with my query.

Thanks

Upvotes: 2

Views: 857

Answers (1)

Rohail Abbas
Rohail Abbas

Reputation: 581

Although it's been two years but writing my answer as it may help others. This was being achieved using logstash-filter-redis in logstash 1.x but was discontinued perhaps after logstash 4.x I had the same requirement and I used ruby filter to get it done.


filter {

 ruby {
     init =>
      "
       require 'redis'
       require 'json'
      "

     code =>
      "
       pidvalue = (event.get('pid'))
       if pidvalue
          redis = Redis.new(url: 'redis://@myredisdb.com:6379') 
          result = redis.get(pidvalue)
       redis.quit
       if result
         resultParsd = JSON.parse(result)
         event.set('esvar1', resultParsd['redisvar1'])
         event.set('esvar2', resultParsd['redisvar2'])
         event.set('esvar3', resultParsd['redisvar3'])   
      end
      end
      "
   }
}

Upvotes: 1

Related Questions