【Flume 1.6.0】5、Flume Interceptors

1、Timestamp Interceptor

在event headers中，添加timestamp標籤

[root@hftest0001 conf]# pwd
/opt/apache-flume-1.6.0-bin/conf

[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf 

agent.sources = exec_tail
agent.channels = memoryChannel
agent.sinks = loggerSink

agent.sources.exec_tail.type = exec
agent.sources.exec_tail.command = tail -F /opt/flume-data/exec-tail.log
agent.sources.exec_tail.channels = memoryChannel

agent.sources.exec_tail.interceptors = i1
agent.sources.exec_tail.interceptors.i1.type = timestamp
#agent.sources.exec_tail.interceptors.i1.preserveExisting = true

agent.sinks.loggerSink.type = logger
#agent.sinks.loggerSink.maxBytesToLog = 1
agent.sinks.loggerSink.channel = memoryChannel

agent.channels.memoryChannel.type = memory
agent.channels.memoryChannel.capacity = 100

===>結果
Event: { headers:{timestamp=1452668731658} body: 78 78                                           xx }

2、Host Interceptor

獲取agent部署那臺server的ip或是hostname，或添加到host標籤中

[root@hftest0001 conf]# pwd
/opt/apache-flume-1.6.0-bin/conf
[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf 

agent.sources.exec_tail.type = exec
agent.sources.exec_tail.command = tail -F /opt/flume-data/exec-tail.log
agent.sources.exec_tail.channels = memoryChannel

agent.sources.exec_tail.interceptors = i1 i2
agent.sources.exec_tail.interceptors.i1.type = timestamp
#agent.sources.exec_tail.interceptors.i1.preserveExisting = true

agent.sources.exec_tail.interceptors.i2.type = host
#agent.sources.exec_tail.interceptors.i2.userIP = false                =>default:true 設置爲false，則獲取的值爲hostname
#agent.sources.exec_tail.interceptors.i2.hostHeader = hostname        => default:header中key爲host,能夠設置更改
#agent.sources.exec_tail.interceptors.i2.preserveExisting = true

agent.sinks.loggerSink.type = logger
#agent.sinks.loggerSink.maxBytesToLog = 1
agent.sinks.loggerSink.channel = memoryChannel

agent.channels.memoryChannel.type = memory
agent.channels.memoryChannel.capacity = 100

===>result 
Event: { headers:{timestamp=1452669139164, host=${ip}} body: 78 78                                           xx }

3、Static Interceptor

自定義向header中添加k-v: 用途，如想知道events是那個dc的，那個country，那個city。也能夠根據這些header信息，進行數據分流等等

[root@hftest0001 conf]# pwd
/opt/apache-flume-1.6.0-bin/conf
[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf 

#agent.sources.exec_tail.interceptors.i2.userIP = false
#agent.sources.exec_tail.interceptors.i2.hostHeader = hostname
#agent.sources.exec_tail.interceptors.i2.preserveExisting = true

agent.sources.exec_tail.interceptors.i3.type = static
agent.sources.exec_tail.interceptors.i3.key = country
agent.sources.exec_tail.interceptors.i3.value = USA

agent.sources.exec_tail.interceptors.i4.type = static
agent.sources.exec_tail.interceptors.i4.key = city
agent.sources.exec_tail.interceptors.i4.value = NEW_YORK


agent.sinks.loggerSink.type = logger
#agent.sinks.loggerSink.maxBytesToLog = 1
agent.sinks.loggerSink.channel = memoryChannel

agent.channels.memoryChannel.type = memory
agent.channels.memoryChannel.capacity = 100

===> result
Event: { headers:{timestamp=1452669538967, host=${IP}, city=NEW_YORK, country=USA} body: 78 78                                           xx }

4、Regex Filtering Interceptor

5、Regex Extractor Interceptor