Update ddoc.
This commit is contained in:
48
README.md
48
README.md
@@ -38,6 +38,54 @@ The current list of supported filters are:
|
|||||||
4. [Json](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
4. [Json](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
||||||
5. [GeoIP](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
5. [GeoIP](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
||||||
|
|
||||||
|
Note that there are now two syntaxes for filters, array and single, if you want more than one filter of the same
|
||||||
|
type then you must use the array tag instead of the singular tag. i.e:
|
||||||
|
|
||||||
|
A single Json filter using the single tag
|
||||||
|
```json
|
||||||
|
"Filters": [
|
||||||
|
{
|
||||||
|
"json": {
|
||||||
|
"type": "Win32-FileLog",
|
||||||
|
"condition": "\"[logSource]\" == \"dev\"",
|
||||||
|
"source": "Text",
|
||||||
|
"add_field": [
|
||||||
|
"_index",
|
||||||
|
"dev-%{yyyy.MM.dd}"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
```
|
||||||
|
|
||||||
|
Multiple Json filters must use the jsonFilters and array syntax
|
||||||
|
```json
|
||||||
|
"Filters": [
|
||||||
|
{
|
||||||
|
"jsonFilters": [
|
||||||
|
{
|
||||||
|
"type": "Win32-FileLog",
|
||||||
|
"condition": "\"[logSource]\" == \"dev\"",
|
||||||
|
"source": "Text",
|
||||||
|
"add_field": [
|
||||||
|
"_index",
|
||||||
|
"dev-%{yyyy.MM.dd}"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "Win32-FileLog",
|
||||||
|
"condition": "\"[logSource]\" == \"sta\"",
|
||||||
|
"source": "Text",
|
||||||
|
"add_field": [
|
||||||
|
"_index",
|
||||||
|
"sta-%{yyyy.MM.dd}"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
```
|
||||||
|
|
||||||
## JSON
|
## JSON
|
||||||
Since TimberWinR only ships to Redis and Elasticsearch, the format generated by TimberWinR is JSON. All fields referenced by TimberWinR can be
|
Since TimberWinR only ships to Redis and Elasticsearch, the format generated by TimberWinR is JSON. All fields referenced by TimberWinR can be
|
||||||
represented as a JSON Property or Array.
|
represented as a JSON Property or Array.
|
||||||
|
|||||||
Reference in New Issue
Block a user