Reading Logstash configurations

In order to decode a Logstash configuration, you can use parse_lscl().

Warning

As described in logstash.yml, the parsing of the pipeline in Logstash Configuration Language depends on settings provided aside, which means the configuration you want to read has been made for a Logstash instance with the following settings:

  • config.support_escapes, for which the value must be mirrored to the support_escapes kwarg;

  • config.field_reference.escape_style, for which the value must be mirrored to the field_reference_escape_style kwarg.

By default, these are considered undefined in the assumed Logstash instance, and as such, are defined to the same default value as in Logstash.

An example is the following:

from lscl.parser import parse_lscl

with open("/path/to/logstash.yaml") as fp:
    parsed_result = parse_lscl(fp.read())

The result will be expressed using a list of LsclBlock, LsclData and LsclConditions you can explore recursively.