A Lua filter runs Lua code inside a Fluent Bit pipeline to process event records when configuration-only filters are not enough. Use it to combine several transformations in one step, add computational logic, convert dates with time-zone or daylight-saving handling, or mask sensitive values in uncommon formats. section 7.6
A callback receives a tag, timestamp, and record. The record is a Lua table, so code can inspect fields, traverse nested tables, add attributes, and replace values. The callback returns a response code that tells Fluent Bit whether to retain, update, or delete the event; choose the code that matches whether the record, timestamp, or both changed. section 7.6.2
Table 7.1 Response-code values and their meanings
|
Code
|
Meaning
|
|---|---|
|
–1
|
The record needs deleting.
|
|
0
|
All values are unmodified.
|
|
1
|
Both timestamp and record structures have changed, and the Fluent Bit record needs to be updated.
|
|
2
|
Only the record has changed, and the timestamp remains unmodified.
|
Use the response-code table to select the callback result: delete a record, leave it unchanged, update its record only, or update both record and timestamp. section 7.6.2
Configure a Lua filter by connecting these pieces:
- Match the filter against the tags it should process, then point script to a Lua file and call to its callback function. section 7.6.2
- Embed Lua with the code setting when keeping a small transformation beside its YAML pipeline configuration is more convenient. section 7.6.2
- Set time_as_table when the callback needs timestamp components as a table; changing that setting changes how Lua sees and displays the timestamp. section 7.6.2
- Attach the same Lua parameters through a processors declaration when processing log events in a processor pipeline. section 9.2.1
Count fields and enrich a record
A recursive Lua function can count elements in a record, including nested request data. A callback can then change remote_user when present, add element_count, and return the code for a changed record with an unchanged timestamp. Running a dummy-input pipeline sends the transformed events to output while Lua prints the fields it traversed. section 7.6.2
Modify generated log events with a processor
A Lua processor for random log events saves rand_value as original_val, divides and replaces the value, adds the event tag, and truncates ping output. The resulting stdout events contain both the original and modified values, making the transformation directly visible. section 9.2.1
