Flume has the capability to modify/drop events in-flight.this done with the help of interceptors. Interceptors are classes that implement org.apache.flume.interceptor interface.An Interceptor can modify or even drop events bases on any criteria chosen by the developer of the interceptor.Flume supports bulider class banes in the configuration the otder in which the interceptors is passed to the next interceptor in th chain terceptors can modify or drop evebts if an interceptor needs to drop events it just does not return that event in the list that it returns if it is drop all events then it simply returns can empty list interceptors ate named components here is an example of how they are created through configuration;
Timestamp interceptor 和Host Interceptor 这两个拦截器
分别给每个event头部插入 时间戳 和代理agent的IP
Static Interceptor
允许在event的头部追加一个静态的值
Remove Header Interceptor
用于移除头部静态定义 如果不符合匹配到标准则不会移除归结到一点就是看你定义的移除内容
UUID INterceptor
给所有拦截的event 给定一个独立唯一的身份号码
Morephline Interceptor
这个拦截器过滤events 通过一个 morphline configuration文件
这个文件定义着一个管式指令链
Search and Replace Interceptor
这个拦截器提供了一个子串基础 查询替换 的基本功能 通过java的常规表达
Backtracking/group capture is also avaliable.这个拦截器的规则在java的 Matcher.replaceAll()方法.
Regex Filtering Interceptor Regex Extractor Interceptor
正则表达式拦截器 正则表达式提取器
正则表达式匹配对时间
提供的正则表达式可以应用于事件或者排除事件
