我将数据从logstash推送到elasticsearch,但我注意到数据类型不匹配。我有地理点是字符串,日期是字符串,等等。
如何在logstash conf文件中设置字段类型?我知道我可以使用命令来更改类型,但是如果我每天都创建一个新索引,我就不想自动执行这些命令。
我想有一种方法可以在conf文件中,在filter或output中实现。我只是不知道去哪里,怎么去。
这是我一直在做的。
input {
http_poller {
...
}
}
filter {
split {
field => "[bustime-response][vehicle]"
}
mutate {
rename => {
"[bustime-response][vehicle][vid]" => "vid"
"[bustime-response][vehicle][rtpidatafeed]" => "rtpidatafeed"
"[bustime-response][vehicle][tmstmp]" => "tmstmp"
"[bustime-response][vehicle][lat]" => "lat"
"[bustime-response][vehicle][lon]" => "lon"
"[bustime-response][vehicle][hdg]" => "hdg"
"[bustime-response][vehicle][pid]" => "pid"
"[bustime-response][vehicle][rt]" => "rt"
"[bustime-response][vehicle][des]" => "des"
"[bustime-response][vehicle][pdist]" => "pdist"
"[bustime-response][vehicle][dly]" => "dly"
"[bustime-response][vehicle][spd]" => "spd"
"[bustime-response][vehicle][tatripid]" => "tatripid"
"[bustime-response][vehicle][origtatripno]" => "origtatripno"
"[bustime-response][vehicle][tablockid]" => "tablockid"
"[bustime-response][vehicle][zone]" => "zone"
"[bustime-response][vehicle][mode]" => "mode"
"[bustime-response][vehicle][psgld]" => "psgld"
}
}
mutate {
add_field => { "location" => "%{lat},%{lon}" }
}
}
output {
elasticsearch {
hosts => [ "${ES_HOSTS}" ]
user => "${ES_USER}"
password => "${ES_PASSWORD}"
cacert => '/etc/logstash/certificates/ca.crt'
index => "transit-pittsburgh-%{+YYYY.MM.dd}"
}
暂无答案!
目前还没有任何答案,快来回答吧!