更改Logstash配置文件中“字段”内的特定“值”

2q5ifsrm  于 2022-12-09  发布在  Logstash
关注(0)|答案(2)|浏览(186)

我想更改logstash配置文件字段中的值。
对于我的情况,我的logstash配置文件是这样的。

# Read input from filebeat by listening to port 5044 on which filebeat will send the data
input {
    beats {
        port => "5044"
    }
}

filter {
    ######################################### For Solr ############################################## 
    if "solr" in [log][file][path] {
        grok {
            match => {"message" => "%{DATA:timestamp}%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## For Server ############################################## 
    if "server.log" in [log][file][path] {
        grok {
            match => {"message" => "%{DATA:timestamp}%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA}\]%{SPACE}\(%{DATA:thread}\)%{SPACE}%{GREEDYDATA:log-message}"}
            #match => { "[log][file][path]" => "%{GREEDYDATA}/%{GREEDYDATA:jboss-log}.log"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        } 
        
    }
    
    ############################################## For Mongo ############################################## 
    else if "mongos" in [log][file][path] or "config" in [log][file][path] or "shard" in [log][file][path] or "metrics_" in [log][file][path]{
        grok {
            match => {"message" => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    ############################################## For mongo.log #####################################################
    else if "mongo" in [log][file][path] {
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    ############################################## For Kafka ############################################## 
    else if "kafka" in [log][file][path] {
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## For mongodb_output & mongodb_exception ############################################## 
    else if "mongodb_exception" in [log][file][path] or "mongodb_output" in [log][file][path]{
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## Other Logs ##############################################
    else {
        grok {
            #match => {"message" => "\[%{MONTHDAY:day}%{SPACE}%{MONTH:month}%{SPACE}%{YEAR:year},%{SPACE}%{TIME:time}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]\[%{DATA:thread}\]%{SPACE}%{GREEDYDATA:log-message}"}
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]\[%{DATA:thread}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
   
   
   
   ################################################################
   
   grok {
        match => { "[log][file][path]" => ["%{GREEDYDATA}/%{GREEDYDATA:component}.log" , "%{PATH}\\%{GREEDYDATA:component}\_%{GREEDYDATA}.log" ]}
   }
   
   if [component] =~ "^server" {
        mutate {
            rename => { "%{server}" => "renamed_server" }
        }   
   }
       
} 

output {
    
    # sending properly parsed log events to elasticsearch
    elasticsearch {
            hosts => ["localhost:9200"]
    }
}

我将component字段的值设置为server,但我希望将component字段的值server更改为renamed_server
我已经尝试了上述方法,但没有得到任何输出。
请帮我找出所需的解决方案。

rqdpfwrv

rqdpfwrv1#

我猜问题出在这个区块:

if [component] =~ "^server" {
  mutate {
    rename => { "%{server}" => "renamed_server" }
  }   
}

..因为它不做你想要的,即
我想将组件字段server的更改为rename_server。
rename mutate配置不会更改值,而是重命名字段。
如果你想改变值,你可以使用gsub。既然你想改变确切的值,也许你可以完全不使用条件。例如:

mutate {
      gsub => [
        # replace `server` value with `renamed_server` in component field
        "component", "^server$", "renamed_server"
      ]
    }
rqcrx0a6

rqcrx0a62#

我已经用gsub修改了这个字段,它也工作得很好。

mutate {
        gsub => [
            "component", "^server$", "renamed_server",
            "component", "^[0-9]{3}.*[0-9]{3}.*[0-9]{2}.*[0-9]{2}.*[0-9]{5}.*output$" , "client_output"
        ]
}

相关问题