https://github.com/thomas-touhey/lscl
Logstash configuration language handling. (Gitlab.com mirror)
https://github.com/thomas-touhey/lscl
logstash parser python
Last synced: over 1 year ago
JSON representation
Logstash configuration language handling. (Gitlab.com mirror)
- Host: GitHub
- URL: https://github.com/thomas-touhey/lscl
- Owner: thomas-touhey
- License: other
- Created: 2024-06-16T21:05:02.000Z (about 2 years ago)
- Default Branch: develop
- Last Pushed: 2025-02-04T10:56:21.000Z (over 1 year ago)
- Last Synced: 2025-02-04T11:32:05.153Z (over 1 year ago)
- Topics: logstash, parser, python
- Language: Python
- Homepage: https://lscl.touhey.pro/
- Size: 202 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.rst
- License: LICENSE.txt
- Security: SECURITY.txt
Awesome Lists containing this project
README
lscl -- Logstash configuration language handling
================================================
lscl is a Python module for parsing and rendering Logstash_ configurations
in its own language, named LSCL for "LogStash Configuration Language".
The project is present at the following locations:
* `Official website and documentation at
lscl.touhey.pro `_;
* `lscl repository on Gitlab `_;
* `lscl project on PyPI `_.
As described in `Reading Logstash configurations`_ and `Rendering
Logstash configurations`_, you can use this module to create, parse, update
and render Logstash pipelines. Here is an example where lscl is used to add
an ``add_field`` operation on an existing pipeline:
.. code-block:: python
from lscl.lang import LsclAttribute, LsclBlock
from lscl.parser import parse_lscl
from lscl.renderer import render_as_lscl
SOURCE = """
input {
stdin { }
}
filter {
dissect {
mapping => {
"message" => "[%{ts}] %{message}"
}
}
}
output {
elasticsearch { codec => rubydebug }
}
"""
content = parse_lscl(SOURCE)
# Find the 'filter' block at top level.
# If the block is not found, create it.
for el in content:
if isinstance(el, LsclBlock) and el.name == "filter":
break
else:
el = LsclBlock(name="filter")
content.append(el)
# Add the add_field filter.
el.content.append(
LsclBlock(
name="mutate",
content=[
LsclAttribute(name="add_field", content={"mytag": "myvalue"}),
],
)
)
print(render_as_lscl(content), end="")
The script will output the following:
.. code-block:: text
input {
stdin {}
}
filter {
dissect {
mapping => {
message => "[%{ts}] %{message}"
}
}
mutate {
add_field => {
mytag => myvalue
}
}
}
output {
elasticsearch {
codec => rubydebug
}
}
.. _Logstash: https://www.elastic.co/fr/logstash
.. _lscl website: https://lscl.touhey.pro/
.. _lscl on Gitlab: https://gitlab.com/kaquel/lscl
.. _lscl on PyPI: https://pypi.org/project/lscl
.. _Reading Logstash configurations:
https://lscl.touhey.pro/developer-guides/read.html
.. _Rendering Logstash configurations:
https://lscl.touhey.pro/developer-guides/render.html