-
A note for the community
Problem
hi, I push data from kafka by vector, and I used transformer to conver ip info, and write it to file. most times, it works well, but few times, it will reflect on error:
Can I detect when the transformer is doing the conversion, and if an error is encountered, give .geo_ip a default value? just like: .geo_ip,err = get_enrichment_table_record!("geoip_table",{"ip": .dissect.remote_ip})
if (err !=null){
.geo_ip={"city_name":"unknon"}
} In this way, I can get the correct results. Thanks! Configuration
Example Data
{
"@timestamp": "2024-05-10T06:11:45.833Z",
"message": {
"dissect": {
"UA": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",
"access_date": "2024-04-09",
"access_time": "18:00:27",
"http_code": "302",
"http_host": "abc.com",
"referer": "-",
"remote_ip": "103.190.179.11",
"request_bytes": "113",
"request_method": "GET",
"resp_bytes": "267",
"resp_cost": "0",
"uri": "/index.do"
}
}
}
Additional ContextNo response ReferencesNo response |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
Hi @saltfishh , You can check for errors like:
That is: remove the |
Beta Was this translation helpful? Give feedback.
-
it works, thanks for that! |
Beta Was this translation helpful? Give feedback.
Hi @saltfishh ,
You can check for errors like:
That is: remove the
!
from the function call. The!
tells VRL to abort if the function fails; otherwise it'll return anerr
value. This is documented here: https://vector.dev/docs/reference/vrl/expressions/#function-call