Reading Logstash configurations¶

There are multiple ways to use the module to actually read a Logstash configuration: decode the configuration file directly, and evaluate the configuration file in order to decode specific elements of the configuration.

Warning

As described in logstash.yml, the parsing of the pipeline in Logstash Configuration Language depends on settings provided aside, which means the configuration you want to read has been made for a Logstash instance with the following settings:

config.support_escapes, for which the value must be mirrored to the support_escapes kwarg;
config.field_reference.escape_style, for which the value must be mirrored to the field_reference_escape_style kwarg.

By default, these are considered undefined in the assumed Logstash instance, and as such, are defined to the same default value as in Logstash.

Only decode a Logstash configuration¶

In order to decode a Logstash configuration, you can use parse_lscl():

from lscl.parser import parse_lscl

with open("/path/to/logstash.yaml") as fp:
    parsed_result = parse_lscl(fp.read())

The result will be expressed using a list of LsclBlock, LsclData and LsclConditions you can explore recursively.

Decode Logstash filters¶

In order to decode raw Logstash filters, you can use parse_logstash_filters():

from lscl.filters import parse_logstash_filters

with open("/path/to/logstash.yaml") as fp:
    parsed_result = parse_logstash_filters(fp.read())

The result will be expressed using a list of LogstashFilter and LogstashFilterBranching you can explore recursively.