devlatte

exports.handler = async (event, context) => {
    const output = event.records.map((record) => {
        
        const arrived_ts = record.approximateArrivalTimestamp;
        const buff = Buffer.from(record.data, 'base64');
        const obj = JSON.parse(buff.toString());
        obj.arrived_ts = arrived_ts;
        record.data = Buffer.from(JSON.stringify(obj) + "\n").toString('base64');
        record.result = 'Ok';
        return record;

devlatte

select regexp_replace('100000', '(\d{1,3})(?=(\d{3})+(?!\d))', '$1,');

devlatte

# when 'browser timezone' is not working or not supported ganglia version

# ganglia/conf.php
# for graph(rddtool) timezone
$conf['rrdtool'] = "env TZ='Asia/Seoul' /usr/bin/rrdtool";


# ganglia/header.php
# for header (query) time
<?php

devlatte

filter{
    ruby {
        code => "h = event.get('[record][param]').to_hash; if h.has_key?('') then h['_LS_EMPTY_KEY']=h['']; h.delete(''); event.set('[record][param]', h) end"
    }
}

# rename empty key field using ruby filter
# solution for error msg "name cannot be empty string" in elasticsearch output plugin

devlatte

filter{
    ruby {
        code => "event.set('message', event.get('message').split(/\001\s+/, -1)); event.set('@timestamp', LogStash::Timestamp.now)"
        add_field => {
            "time" => "%{[message][0]}"
            "level" => "%{[message][1]}"
            "thread" => "%{[message][2]}"
            "msg" => "%{[message][3]}"
            "location" => "%{[message][4]}"
            "stacktrace" => "%{[message][5]}"

devlatte

//from pure package
export http_proxy="proxy.host:3128"
export https_proxy=$http_proxy

export JRUBY_OPTS="-J-Dhttp.proxyHost=proxy.host -J-Dhttp.proxyPort=3128"
DEBUG=1 JARS_SKIP='true' bin/logstash-plugin install logstash-filter-json_encode