正则表达式处理器插件
此插件使用正则表达式模式转换标签和字段值，以及重命名标签、字段和指标。标签和字段值可以使用命名组进行批量转换。
regex 处理器仅处理字符串字段。它不适用于任何其他数据类型，如整数或浮点数。
引入于: Telegraf v1.7.0 标签: transformation 操作系统支持: all
全局配置选项
插件支持其他全局和插件配置设置，用于修改指标、标签和字段，创建别名以及配置插件顺序等任务。更多详情请参阅 CONFIGURATION.md。
配置
# Transforms tag and field values as well as measurement, tag and field names with regex pattern
[[processors.regex]]
namepass = ["nginx_requests"]
## Tag value conversion(s). Multiple instances are allowed.
[[processors.regex.tags]]
## Tag(s) to process with optional glob expressions such as '*'.
key = "resp_code"
## Regular expression to match the tag value. If the value doesn't
## match the tag is ignored.
pattern = "^(\\d)\\d\\d$"
## Replacement expression defining the value of the target tag. You can
## use regexp groups or named groups e.g. ${1} references the first group.
replacement = "${1}xx"
## Name of the target tag defaulting to 'key' if not specified.
## In case of wildcards being used in `key` the currently processed
## tag-name is used as target.
# result_key = "method"
## Appends the replacement to the target tag instead of overwriting it when
## set to true.
# append = false
## Field value conversion(s). Multiple instances are allowed.
[[processors.regex.fields]]
## Field(s) to process with optional glob expressions such as '*'.
key = "request"
## Regular expression to match the field value. If the value doesn't
## match or the field doesn't contain a string the field is ignored.
pattern = "^/api(?P<method>/[\\w/]+)\\S*"
## Replacement expression defining the value of the target field. You can
## use regexp groups or named groups e.g. ${method} references the group
## named "method".
replacement = "${method}"
## Name of the target field defaulting to 'key' if not specified.
## In case of wildcards being used in `key` the currently processed
## field-name is used as target.
# result_key = "method"
## Rename metric fields
[[processors.regex.field_rename]]
## Regular expression to match on the field name
pattern = "^search_(\\w+)d$"
## Replacement expression defining the name of the new field
replacement = "${1}"
## If the new field name already exists, you can either "overwrite" the
## existing one with the value of the renamed field OR you can "keep"
## both the existing and source field.
# result_key = "keep"
## Rename metric tags
[[processors.regex.tag_rename]]
## Regular expression to match on a tag name
pattern = "^search_(\\w+)d$"
## Replacement expression defining the name of the new tag
replacement = "${1}"
## If the new tag name already exists, you can either "overwrite" the
## existing one with the value of the renamed tag OR you can "keep"
## both the existing and source tag.
# result_key = "keep"
## Rename metrics
[[processors.regex.metric_rename]]
## Regular expression to match on an metric name
pattern = "^search_(\\w+)d$"
## Replacement expression defining the new name of the metric
replacement = "${1}"请注意，您可以在一个处理器中使用多个 tags、fields、tag_rename、field_rename 和 metric_rename 部分。所有这些都会被应用。
标签和字段值转换
仅当标签/字段名称匹配 key（可以包含通配符，如 *）并且 pattern 匹配标签/字段值时，才会应用转换。对于字段，字段值必须是 string 类型才能应用转换。如果任何给定条件不适用，则不会将转换应用于指标。
replacement 选项指定结果标签或字段的值。它可以按索引（例如，${1} 是第一个捕获组）或按名称（例如，${mygroup} 是名为 mygroup 的捕获组）引用捕获组。
默认情况下，当前正在处理的标签或字段将被 replacement 覆盖。要创建新的标签或字段，您可以另外指定 result_key 选项，其中包含新的目标标签或字段名称。如果给定的标签或字段已存在，则其值将被覆盖。对于 tags，您可以使用 append 标志将 replacement 值附加到现有标签。
使用命名组进行批量处理
在 tags 和 fields 部分，可以使用命名组分别创建多个新标签或字段。为此，所有捕获组都必须在 pattern 中命名。允许包含额外的非捕获组或其他表达式。此外，replacement 和 result_key 不能设置为结果标签/字段名称，因为它们是组的名称，值对应于组的内容。
标签和字段名称转换
您可以使用 tag_rename 和 field_rename 部分批量重命名标签和字段。与 tags 和 fields 部分相反，重命名操作作用于标签或字段的名称，而不是其值。
如果给定的 pattern 匹配名称，则会重命名标签或字段。新名称通过 replacement 选项指定。可以选择将 result_key 设置为 overwrite 或 keep（默认），以控制目标标签/字段已存在时的行为。对于 overwrite，目标标签/字段将被源键替换。使用此设置，源标签/字段无论如何都会被删除。使用 keep 设置（默认）时，目标标签/字段和源标签/字段都将保持不变，并且不会进行重命名。
指标名称转换
与标签和字段重命名类似，可以使用 metric_rename 部分重命名与给定 pattern 匹配的指标。结果指标名称通过 replacement 选项给出。如果匹配 pattern，则始终应用转换。result_key 选项对指标重命名没有影响，不应指定。
示例
在以下示例中，我们使用此指标
nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000显式指定
[[processors.regex]]
namepass = ["nginx_requests"]
[[processors.regex.tags]]
key = "resp_code"
pattern = "^(\\d)\\d\\d$"
replacement = "${1}xx"
[[processors.regex.fields]]
key = "request"
pattern = "^/api(?P<method>/[\\w/]+)\\S*"
replacement = "${method}"
result_key = "method"
[[processors.regex.fields]]
key = "request"
pattern = ".*category=(\\w+).*"
replacement = "${1}"
result_key = "search_category"
[[processors.regex.field_rename]]
pattern = "^client_(\\w+)$"
replacement = "${1}"将导致
-nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
+nginx_requests,verb=GET,resp_code=2xx request="/api/search/?category=plugins&q=regex&sort=asc",method="/search/",category="plugins",referrer="-",ident="-",http_version=1.1,agent="UserAgent",ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
附加
[[processors.regex]]
namepass = ["nginx_requests"]
[[processors.regex.tags]]
key = "resp_code"
pattern = '^2\d\d$'
replacement = " OK"
result_key = "verb"
append = true将导致
-nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
+nginx_requests,verb=GET\ OK,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
命名组
[[processors.regex]]
namepass = ["nginx_requests"]
[[processors.regex.fields]]
key = "request"
pattern = '^/api/(?P<method>\w+)[/?].*category=(?P<category>\w+)&(?:.*)'将导致
-nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
+nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",method="search",category="plugins",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
指标重命名
[[processors.regex]]
[[processors.regex.metric_rename]]
pattern = '^(\w+)_.*$'
replacement = "${1}"将导致
-nginx_requests,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
+nginx,verb=GET,resp_code=200 request="/api/search/?category=plugins&q=regex&sort=asc",referrer="-",ident="-",http_version=1.1,agent="UserAgent",client_ip="127.0.0.1",auth="-",resp_bytes=270i 1519652321000000000
此页面是否有帮助？
感谢您的反馈！
支持和反馈
感谢您成为我们社区的一员！我们欢迎并鼓励您对 Telegraf 和本文档提出反馈和 bug 报告。要获取支持，请使用以下资源
具有年度合同或支持合同的客户可以 联系 InfluxData 支持。