技巧来缩进vim中的logstash文件

Posted 2023-01-12

请您帮我一个技巧，在vim中使用两个替换缩进logstash文件吗？

例如此

input 
  stdin 
  codec => "json"
 
  

filter 
    json 
    source => "Filebeat"
target => "Filebeat"
   
            
 output
  elasticsearch 
    hosts => ["localhost"]
 index => "dhcp-%+YYYY.MM-11"
   
   

将是

input 
  stdin 
    codec => "json"
  


filter 
  json 
    source => "Filebeat"
    target => "Filebeat"
  

output
  elasticsearch 
    hosts => ["localhost"]
    index => "dhcp-%+YYYY.MM-11"
  

这是logstash配置文件的另一个示例

input 
   file 
      path => "/usr/share/logstash/hola/*.xml"
      type => "hola"
      start_position => "beginning"
      sincedb_path => "/usr/share/logstash/sincedb/hola"
      codec => multiline 
         pattern => "</HOLA>"
         negate => true
         what => "next"
      
      codec => plain 
         charset => "UTF-8"
      
      max_open_files => "30000"
   


filter 
   if [type] == "hola" 
      mutate 
        add_field =>  "[rrrrrrr][name]" => "hola" 
      
      mutate 
         gsub => [
            "message", "&", "E",
            "message", "<\?xml .*\?>", "",
            "message", "<BLOCO>", "",
            "message", "<\/BLOCO>", "",
            "message", "<br>", "",
            "message", "    ", ""
         ]
         strip => ["message"]
      

      xml 
         source => message
         target => hola
      

      if ![hola] 
         drop 
         
      

      fingerprint 
         method => "SHA256"
         key => "433247"
         source => [ "message" ]
      

      mutate 
         convert => 
            "[hola][CrD_rILrAr]" => "string"
         

         remove_field => [ "message" ]
      

      date 
         match => [ "[hola][DT_ffffff][0]", "dd/MM/yyyy HH:mm:ss" ]
         timezone => 'America/LIMA'
      
   


output 
    if [type] == "hola" 
       elasticsearch 
           hosts => [
           "xxxtal.com",
           "xxxtal.com",
           "xxxtal.com",
           "xxxtal.com"
           ]
           user => logstash
           password => xxxx
           document_id => "%fingerprint"
           index => "hola-%+YYYY.MM"
       
    

答案

我制作了一个密钥映射，该映射基本上为您的用例实现了自定义缩进。它适用于您提供的较大示例。可能不是最好的解决方案，当然也不是最干净的解决方案，但是您可以从这里开始：

nmap <F2> :%s/^\s*<CR>:g//+ normal >G<CR>:g//normal <G<CR>:g/.*/normal >><CR>:g/\[/+ normal >G<CR>:g/\]/normal <G<CR>:g/\[.*\]/normal >><CR>

它的作用是：

• 删除所有缩进。
• 对于每个或[，将文件的其余部分向右缩进一个。
• 对于每个或]，将文件的其余部分向左缩进一个字，包括找到括号的行。
• 具有.*和/或[.*]的每行也向左缩进一个。

就像我一直在钻，不是最干净的方法，但是它似乎可以工作。也正在寻找插件来做同样的事情，但是似乎logstash文件不存在这些插件。