schema

Used to convert log format.
Source interceptor.

Use Cases

For some log scenarios, there may be some differences in the log format we require. These differences are mainly in the time field, body field, and so on. By default, Loggie will only put the raw data collected or received by the source into the body field and send it in the simplest way:

{
    "body": "this is raw data"
}

But, sometimes, we need to:

• add time field
• modify body and other fields

Example

add @timestamp, modify body to message

interceptors:
  - type: schema
    addMeta:
      timestamp:
        key: "@timestamp"
    remap:
      body:
        key: message

event converted:

{
  "message": "this is raw data"
  "@timestamp": "2022-08-30T06:58:49.545Z",
}

add timestamp，modify timezone and format, modift body to log

interceptors:
  - type: schema
    addMeta:
      timestamp:
        key: "_timestamp_"
        location: Local
        layout: 2006-01-02T15:04:05Z07:00
    remap:
      body:
        key: _log_

Configuration

addMeta

timestamp

pipelineName

Example

interceptors:
  - type: schema
    addMeta:
      pipelineName:
        key: pipeline

event converted:

{
  "pipeline": "demo"
  ...
}

sourceName

Example

interceptors:
  - type: schema
    addMeta:
      sourceName:
        key: source

event converted:

{
  "source": "local"
  ...
}

remap

Example

interceptors:
  - type: schema
    remap:
      body:
        key: msg
      state:
        key: meta

original event:

{
  "body": "this is log"
  "state": "ok",
}

event converted:

{
  "msg": "this is log"
  "meta": "ok",
}