diff --git a/manifest/operations/pipelines/cf-apps-es/filter-15-throttle-logs.conf b/manifest/operations/pipelines/cf-apps-es/filter-15-throttle-logs.conf new file mode 100644 index 0000000..0307da7 --- /dev/null +++ b/manifest/operations/pipelines/cf-apps-es/filter-15-throttle-logs.conf @@ -0,0 +1,29 @@ +filter { + + throttle { + before_count => "${THROTTLE_SAME_MESSAGE_BEFORE_COUNT}" + after_count => "${THROTTLE_SAME_MESSAGE_AFTER_COUNT}" + period => "${THROTTLE_SAME_MESSAGE_PERIOD}" + max_age => "${THROTTLE_SAME_MESSAGE_MAX_AGE}" + key => "%{[@cf][app_id]}%{[@message]}" + add_tag => ["throttle", "throttled_same_message"] + } + + if "throttle_same_message" in [tags] { + drop { percentage => "${THROTTLE_SAME_MESSAGE_DROP_PERCENTAGE}"} + } + + throttle { + before_count => "${THROTTLE_RATE_LIMIT_BEFORE_COUNT}" + after_count => "${THROTTLE_RATE_LIMIT_AFTER_COUNT}" + period => "${THROTTLE_RATE_LIMIT_PERIOD}" + max_age => "${THROTTLE_RATE_LIMIT_MAX_AGE}" + key => "%{[@cf][app_id]}" + add_tag => ["throttle", "exceed_rate_limit"] + } + + if "throttled" in [tags] { + drop { percentage => "${THROTTLE_RATE_LIMIT_DROP_PERCENTAGE}"} + } + +} diff --git a/manifest/operations/pipelines/cf-apps-es/output-15-custom-stdout.conf b/manifest/operations/pipelines/cf-apps-es/output-15-custom-stdout.conf new file mode 100644 index 0000000..6426e1d --- /dev/null +++ b/manifest/operations/pipelines/cf-apps-es/output-15-custom-stdout.conf @@ -0,0 +1,21 @@ +output { + + if "throttled" in [tags] { + stdout { + codec => line {format => "DROP from Throttled: %{[@cf][app]} %{[@timestamp]} %{[@message]}"} + } + + } else if "throttle_same_message" in [tags] { + stdout { + codec => line {format => "DROP from same message: %{[@cf][app]} %{[@timestamp]} %{[@message]}" + } + } + + } else { + stdout { + codec => line {format => "%{[@cf][app]} %{[@timestamp]} %{[@message]}"} + } + } + +} +