You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| For each processor provide a condition, the event value to check against, and the resulting Kafka topic.
207
-
208
-
Refer to <<processor-conditions,conditions>> in the {agent} processor syntax for condition descriptions. Currently the `equals`, `contains`, and `regexp` conditions are available.
209
-
210
-
Events that don't match against any defined processor are set to the default topic.
211
-
212
-
Processors are applied in the order that they appear, from top to bottom.
213
-
214
-
The value field must be specified in a `[key]: value` format with both the key and value being strings. For example, `host.port: 2000` or `message: Test`.
215
-
216
-
NOTE: Quotation marks are included in the match string. That is, they should be specified in the key or value only if it's expected for them to be included in the events being matched against. So, `message: "error"` will match against the literal string `"error"`, including the quotations marks, and not against the unquoted `error`. This applies to both single (') and double (") quotation marks.
217
-
218
-
As an example for setting up your processors, you might want to route log events based on severity. To do so, you can specify a default topic for all events not matched by other processors:
219
-
220
-
* `%{[fields.log_topic]}`.
221
-
222
-
Then, create a processor to route critical events:
223
-
224
-
* Condition: `Contains`
225
-
* Value: `message: “CRITICAL”`
226
-
* Topic: `critical-%{[agent.version]}`
227
-
228
-
And create another processor to route error events:
229
-
230
-
* Condition: `Contains`
231
-
* Value: `message: “ERR”`
232
-
* Topic: `error-%{[agent.version]}`
233
-
234
-
All non-critical and non-error events will then route to the default `%{[fields.log_topic]}` topic.
198
+
| Set a default topic to use for events sent by {agent} to the Kafka output, for example `elastic-agent`.
0 commit comments