logstash/logstash — pull request #417 by piavlo (2013-03-23 02:00:30+00:00)
Title: Filter/range

This filter is used to check that certain fields are within expected size/length ranges.
Supported types are numbers and strings.
Numbers are checked to be within numeric value range.
Strings are checked to be within string length range.
More than one range can be specified for same fieldname, actions will be applied incrementally.
Then field value is with in a specified range and action will be taken
supported actions are drop event add tag or add field with specified value.

Example usecases are for histogram like tagging of events
or for finding anomaly values in fields or too big events that should be dropped.

filter {
range {
ranges => [ "@message", 0, 10, "tag:short",
"@message", 11, 100, "tag:medium",
"@message", 101, 1000, "tag:long",
"@message", 1001, 1e1000, "drop",
"duration", 0, 100, "field:latency:fast",
"duration", 101, 200, "field:latency:normal",
"duration", 201, 1000, "field:latency:slow",
"duration", 1001, 1e1000, "field:latency:outlier"
"requests", 0, 10, "tag:to_few_%{@host_source}_requests" ]
}
}