码迷,mamicode.com
首页 > 其他好文 > 详细

logstash之filter处理中括号包围的内容

时间:2018-08-02 12:19:52      阅读:825      评论:0      收藏:0      [点我收藏+]

标签:logs   strong   核心   _id   NPU   就是   pac   tac   ace   

 

如题,logstash之filter处理中括号包围的内容:

$grep -v "#" config/logstash-nlp.yml
input {
    kafka {
        bootstrap_servers => "datacollect-1:9092,datacollect-2:9092,datacollect-3:9092"
        codec => "json"
        group_id => "logstash-newtrace-nlptemp"
        topics => ["ot-nlp"]
    }
}
filter {
    grok {
        match => {
            "message" => "^\[%{GREEDYDATA:request}\]$"
        }
    }
    json {
        source => "request"
    }
    ruby {
        code => "event.set(‘temptime‘, event.get(‘@timestamp‘).time.localtime + 8*60*60);"
    }
    grok {
        match => ["temptime", "%{DATA:thedate}T%{NOTSPACE:thetime}Z"]
    }
}
output {
    if ([kafka][topic] =~ "^ot-nlp*") {
        if [name] == "nlp" {
            file {
                codec => line {format => "%{request}"}
                path => "/tmp/newtrace_nlp.log.%{thedate}"
            }
        }
    }
}

 

 

摘出来数组中的所有fields

filter {
    grok {
        match => {
            "message" => "^\[%{GREEDYDATA:request}\]$"
        }
    }
    json {
        source => "request"
        remove_field => [ "message", "request" ]
    }
    split {
        field => "binaryAnnotations"
    }
    json {
        source => "[binaryAnnotations][value]"
    }
}

 

感谢时总的大力支持!!!

 

核心就是正则!

 

        match => {

 

            "message" => "^\[%{GREEDYDATA:request}\]$"

 

        }

 

logstash之filter处理中括号包围的内容

标签:logs   strong   核心   _id   NPU   就是   pac   tac   ace   

原文地址:https://www.cnblogs.com/zhzhang/p/9406233.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!