logstash-filter-influxdb

usage

filter {
  # multiple lines of Influx line protocol in a single event are valid, split on newlines to handle each one individually
  split {
    field => "message"
  }

  # parse the point
  influxdb {
    source => "message"
    target => "point"
    parse_types => true
    time_format => "%Y-%d-%mT%H:%M:%S.%NZ"
  }

  # if it can't be parsed, just drop it (don't really do this)
  if ([point][_influxparseerror]) {
    drop {}
  }
}

options

The second parameter for parse_point is a hash array of options. The current options are

• :parse_types: Parse data types to ruby types (float, int, bool). If false all values in the fields are treated as strings.

  • default: false

• :time_format: Parses the timestamp attribute (if present) and formats it accoring to a strftime format. InfluxDB time is always UTC so is this.

  • default: nil