playbooks/roles/filebeat/files/uc01vn_processor.js

@@ -0,0 +1,42 @@
+function process(event) {
+    var msg = event.Get("message");
+    var i
+
+    msg = msg.replace("/\r/g", "");
+    msg = msg.replace("/\n/g", "");
+    msg = msg.replace("/\r/\n/g", "");
+
+    var fields = msg.split("\t");
+
+    if (Number(fields[1]) == 64) {
+        // log_id = 64的日志是子后台同步过来的，需要特殊处理掉
+        event.Cancel(); return;
+    }
+
+    for (i = 0; i < 25; i++) {
+        if (fields[i] == null) {
+            fields[i] = "";
+        } else if (fields[i].trim() == "-") {
+            fields[i] = "";
+        } else {
+            fields[i] = fields[i].trim();
+        }
+    }
+
+    event.Put("log_datetime", fields[0]);
+    event.Put("log_id", fields[1]);
+    event.Put("role_id", fields[2]);
+    event.Put("role_name", fields[3]);
+    event.Put("account_id", fields[4]);
+
+    var ws = fields[4].split("_") // 从account_id分离spid和channel
+    // account_id中只有第一个部分是描述spid的，故spid和channel使用相同的信息填充
+    event.Put("spid", ws[0]);
+    event.Put("channel", ws[0]);
+
+    for (i = 5; i < fields.length; i++) {
+        event.Put("col" + (i - 4), fields[i]);
+    }
+
+    return event;
+}