Why don't you try writing a custom interceptor? It's quite easy and it gives you the freedom to do anything you want to do with the incoming events.
Regards Mohit On Tuesday, August 18, 2015, Balthasar Schopman < [email protected]> wrote: > Hi, > > We're setting up Flume to monitor the access logs of our web servers. > Flume reads the access logs, but it must also manipulate it. It must add > the hostname and a delimiter char to the start of every line. We're trying > to accomplish this using Interceptors [1]. > > We're able to put any constant string at the start of a line by using the > search/replace interceptor. But how do we make this the hostname? We've > tried using the hostname interceptor, but that only adds the hostname to > the header. Also tried using a variable `%{host}` or `%{hostname}`, but > that isn't replaced by the actual hostname. > > ``` > agent.sources.src.interceptors = host replacer > agent.sources.src.interceptors.host.type = host > agent.sources.src.interceptors.replacer.type = search_replace > agent.sources.src.interceptors.replacer.searchPattern = ^ > agent.sources.src.interceptors.replacer.replaceString = %{host} > ``` > > Any help would be appreciated. If the goal can be achieved in a completely > different way, please let us know. > > [1] http://flume.apache.org/FlumeUserGuide.html#flume-interceptors > > -- > Kind regards, > Balthasar Schopman > LeaseWeb CDN Innovation Engineer > > > Kind regards, > > Balthasar Schopman > Software Developer > LeaseWeb Technologies B.V. > > T: +31 20 316 0232 > M: > E: [email protected] <javascript:;> > W: http://www.leaseweb.com > > Luttenbergweg 8, 1101 EC Amsterdam, Netherlands > > >
