一、Timestamp Interceptor

在event headers中，添加timestamp标签

[root@hftest0001 conf]# pwd/opt/apache-flume-1.6.0-bin/conf[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf agent.sources = exec_tailagent.channels = memoryChannelagent.sinks = loggerSinkagent.sources.exec_tail.type = execagent.sources.exec_tail.command = tail -F /opt/flume-data/exec-tail.logagent.sources.exec_tail.channels = memoryChannelagent.sources.exec_tail.interceptors = i1agent.sources.exec_tail.interceptors.i1.type = timestamp#agent.sources.exec_tail.interceptors.i1.preserveExisting = trueagent.sinks.loggerSink.type = logger#agent.sinks.loggerSink.maxBytesToLog = 1agent.sinks.loggerSink.channel = memoryChannelagent.channels.memoryChannel.type = memoryagent.channels.memoryChannel.capacity = 100===>结果Event: { headers:{timestamp=1452668731658} body: 78 78                                           xx }

二、Host Interceptor

获取agent部署那台server的ip或是hostname，或添加到host标签中

[root@hftest0001 conf]# pwd/opt/apache-flume-1.6.0-bin/conf[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf agent.sources.exec_tail.type = execagent.sources.exec_tail.command = tail -F /opt/flume-data/exec-tail.logagent.sources.exec_tail.channels = memoryChannelagent.sources.exec_tail.interceptors = i1 i2agent.sources.exec_tail.interceptors.i1.type = timestamp#agent.sources.exec_tail.interceptors.i1.preserveExisting = trueagent.sources.exec_tail.interceptors.i2.type = host#agent.sources.exec_tail.interceptors.i2.userIP = false                =>default:true 设置为false，则获取的值为hostname#agent.sources.exec_tail.interceptors.i2.hostHeader = hostname        => default:header中key为host,可以设置更改#agent.sources.exec_tail.interceptors.i2.preserveExisting = trueagent.sinks.loggerSink.type = logger#agent.sinks.loggerSink.maxBytesToLog = 1agent.sinks.loggerSink.channel = memoryChannelagent.channels.memoryChannel.type = memoryagent.channels.memoryChannel.capacity = 100===>result Event: { headers:{timestamp=1452669139164, host=${ip}} body: 78 78                                           xx }

三、Static Interceptor

自定义向header中添加k-v: 用途，如想知道events是那个dc的，那个country，那个city。也可以根据这些header信息，进行数据分流等等

[root@hftest0001 conf]# pwd/opt/apache-flume-1.6.0-bin/conf[root@hftest0001 conf]# vi s-exec_c-m_s-logger.conf #agent.sources.exec_tail.interceptors.i2.userIP = false#agent.sources.exec_tail.interceptors.i2.hostHeader = hostname#agent.sources.exec_tail.interceptors.i2.preserveExisting = trueagent.sources.exec_tail.interceptors.i3.type = staticagent.sources.exec_tail.interceptors.i3.key = countryagent.sources.exec_tail.interceptors.i3.value = USAagent.sources.exec_tail.interceptors.i4.type = staticagent.sources.exec_tail.interceptors.i4.key = cityagent.sources.exec_tail.interceptors.i4.value = NEW_YORKagent.sinks.loggerSink.type = logger#agent.sinks.loggerSink.maxBytesToLog = 1agent.sinks.loggerSink.channel = memoryChannelagent.channels.memoryChannel.type = memoryagent.channels.memoryChannel.capacity = 100===> resultEvent: { headers:{timestamp=1452669538967, host=${IP}, city=NEW_YORK, country=USA} body: 78 78                                           xx }

四、Regex Filtering Interceptor

五、Regex Extractor Interceptor