在vim中缩进logstash文件的技巧

Question

你能帮我用vim中的两个splace来输入日志存储文件吗？

举个例子

input {
  stdin {
  codec => "json"
 }
  }

filter {
    json {
    source => "Filebeat"
target => "Filebeat"
   }
            }
 output{
  elasticsearch {
    hosts => ["localhost"]
 index => "dhcp-%{+YYYY.MM}-11"
   }
   }

将会是

input {
  stdin {
    codec => "json"
  }
}

filter {
  json {
    source => "Filebeat"
    target => "Filebeat"
  }
}
output{
  elasticsearch {
    hosts => ["localhost"]
    index => "dhcp-%{+YYYY.MM}-11"
  }
}

这是logstash配置文件的另一个示例。

input {
   file {
      path => "/usr/share/logstash/hola/*.xml"
      type => "hola"
      start_position => "beginning"
      sincedb_path => "/usr/share/logstash/sincedb/hola"
      codec => multiline {
         pattern => "</HOLA>"
         negate => true
         what => "next"
      }
      codec => plain {
         charset => "UTF-8"
      }
      max_open_files => "30000"
   }
}

filter {
   if [type] == "hola" {
      mutate {
        add_field => { "[rrrrrrr][name]" => "hola" }
      }
      mutate {
         gsub => [
            "message", "&", "E",
            "message", "<\?xml .*\?>", "",
            "message", "<BLOCO>", "",
            "message", "<\/BLOCO>", "",
            "message", "<br>", "",
            "message", "    ", ""
         ]
         strip => ["message"]
      }

      xml {
         source => message
         target => hola
      }

      if ![hola] {
         drop {
         }
      }

      fingerprint {
         method => "SHA256"
         key => "433247"
         source => [ "message" ]
      }

      mutate {
         convert => {
            "[hola][CrD_rILrAr]" => "string"
         }

         remove_field => [ "message" ]
      }

      date {
         match => [ "[hola][DT_ffffff][0]", "dd/MM/yyyy HH:mm:ss" ]
         timezone => 'America/LIMA'
      }
   }
}

output {
    if [type] == "hola" {
       elasticsearch {
           hosts => [
           "xxxtal.com",
           "xxxtal.com",
           "xxxtal.com",
           "xxxtal.com"
           ]
           user => logstash
           password => xxxx
           document_id => "%{fingerprint}"
           index => "hola-%{+YYYY.MM}"
       }
    }
}

Answer 1

我制作了一个关键地图，它基本上实现了您的用例的自定义缩进。它适用于您提供的更大的示例。也许不是最好的解决方案，当然也不是最干净的解决方案，但下面是：

nmap <F2> :%s/^\s*<CR>:g/{/+ normal >G<CR>:g/}/normal <G<CR>:g/{.*}/:><CR>:g/\[/+ normal >G<CR>:g/\]/normal <G<CR>:g/\[.*\]/:><CR>

它所做的是：

将所有indentation.

• For -每个{或[ -缩进文件的其余部分-右方。每个}或]的

• 将文件的其余部分缩进左边，包括括号所在的行。

H 112[>具有d13和/或d14的行也缩进左侧。H 215/code>F 216

就像我说的，这不是最干净的方法，但它似乎有效。同时也在寻找插件来做同样的事情，但是这些插件似乎并不存在于logstash文件中。

编辑：我尝试整理一些命令，但这会打破一些边缘情况，这仍然是最好的结果命令。