Skip to content

Instantly share code, notes, and snippets.

@geekpete
Forked from jsvd/README.md
Created October 6, 2016 06:33
Show Gist options
  • Save geekpete/931d11fe0d6671f528f0e208c0f5f3ec to your computer and use it in GitHub Desktop.
Save geekpete/931d11fe0d6671f528f0e208c0f5f3ec to your computer and use it in GitHub Desktop.
logstash grok filter benchmark script
# encoding: utf-8
require_relative 'logstash/lib/bootstrap/environment'
require 'logstash/environment'
require 'logstash/event'
require_relative './logstash-filter-grok/lib/logstash/filters/grok'
require 'logstash/codecs/base'
require 'benchmark/ips'
line = '220.181.108.96 - - [13/Jun/2015:21:14:28 +0000] "GET /blog/geekery/xvfb-firefox.html HTTP/1.1" 200 10975 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"'
pattern = '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
# grok plugin setup
grok_plugin = LogStash::Filters::Grok.new("match" => ["message", pattern])
grok_plugin.register
# do the benchmark
Benchmark.ips do |x|
x.time = 30
x.warmup = 10
x.report("grok_plugin") do
# we need to create a new event on each iteration since it's modified by grok
event = LogStash::Event.new("message" => line)
grok_plugin.filter(event)
end
# x.report("grok_plugin_2") do
# event = LogStash::Event.new("message" => line)
# grok_plugin_2.filter(event)
# end
x.compare! # necessary only with multiple reports
end
source 'https://rubygems.org'
# Specify your gem's dependencies in logstash-mass_effect.gemspec
gem "logstash-core", :path => "./logstash/logstash-core"
gem "logstash-core-event-java", :path => "./logstash/logstash-core-event-java"
gem "logstash-core-plugin-api", :path => "./logstash/logstash-core-plugin-api"
gem "logstash-filter-grok", :path => "./logstash-filter-grok"
gem "logstash-patterns-core", :path => "./logstash-patterns-core"
gem "benchmark-ips"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment