logstash/puppet-logstash — pull request #101 by vmadman (2013-11-16 06:14:37+00:00)
Title: Logstash 1.2.x

I made these modifications for my own purposes. I have not yet fully tested or documented, but I wanted to show you in case you think its a direction you would want to go.

#### Here's what I've done
- Removed 'format','message_format', and 'charset' from all input plugins
- Added 'codec' and 'conditional' params for all inputs and outputs
- Added 'conditional' to all filters
- Added helper functions: logstash_codec and logstash_conditional

#### What I've not done:
- Fully tested or documented
- Made plugin specific param changes, only codecs and conditions

#### Example usages for codec:
```
# logstash_codec
logstash::output::tcp {'rsyslog-tcp':
port => '5003',
host => '127.0.0.1',
type => 'syslog',
codec => logstash_codec('graphite', {
charset => 'UTF-8'
}),
}

# Codec as string only
logstash::output::tcp {'rsyslog-tcp':
port => '5003',
host => '127.0.0.1',
type => 'syslog',
codec => "graphite{ charset => 'UTF-8' }",
}
```

#### Example usages for conditionals:

```
# logstash_conditional with array of conditions
logstash::filter::alter {'filter-alter':
add_tag => ['one','two'],
conditional => logstash_conditional(['[status] =~ /^5\d\d/','[type] == "apache"'])
}

# logstash_conditional with array of conditions and "OR" delimiter
logstash::filter::alter {'filter-alter':
add_tag => ['one','two'],
conditional => logstash_conditional(['[status] =~ /^5\d\d/','[type] == "apache"'], 'or')
}

# logstash_conditional with string parameter
logstash::filter::alter {'filter-alter':
add_tag => ['one','two'],
conditional => logstash_conditional('[status] =~ /^5\d\d/')
}

# simple string
logstash::filter::alter {'filter-alter':
add_tag => ['one','two'],
conditional => 'if [loglevel] == "ERROR" or [deployment] == "production" {'
}
```

#### Conditional note..

With only a single param for conditionals, it obviously makes nested conditionals very difficult. Else and Else If are also not possible. However, I think all logic can be accomplished with the possibility of "and" and "or" only. It may not be as clean, but its a small price in my opinion.

.. if you're interested I'll polish it up, just let me know.

Thanks,
Luke