zoukankan      html  css  js  c++  java
  • Filter plugins ? mutate:

    filter {
        grok {
            match => [
                 "message" , "s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))?.*s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+
    
    %{NUMBER:bytes}s+(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}",
                  "message" ,"s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+%{NUMBER:bytes}s
    
    +(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}",
                 "message" ,"s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+-s
    
    +(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}",
                 "message","s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+-s
    
    +(%{BASE16FLOAT:request_time})s+(%{IPORHOST:remoteip}|-)"
            ]
        }   
            mutate {
                            convert => [ "request_time", "float"]
                           add_field =>["response_time","%{request_time}"]
                            remove_field =>["request_time"]
                           add_field => [ "[@metadata][zabbix_key]" , "logstash-api-access" ]
                           add_field => [ "[@metadata][zabbix_host]" , "dr-mysql01" ]
                            add_field =>["messager","%{type}-%{message}"]
                             remove_field =>["message"]
                    }
    
    
    Filter plugins ? mutate:
    
    mutate 插件 允许你执行一般的mutations 在字段上,你可以rename, remove, replace, and modify fields in your events.
    
    
    简介:
    
    插件支持下下面的配置选项:
    
    需要的配置选项
    
    mutate {
    }
    
    
    
    

  • 相关阅读:
    网络协议 22
    网络协议 21
    网络协议 20
    网络协议 19
    网络协议 18
    网络协议 17
    网络协议 16
    网络协议 15
    网络协议 14
    .net 4.0 中的特性总结(五):并行编程
  • 原文地址:https://www.cnblogs.com/hzcya1995/p/13350173.html
Copyright © 2011-2022 走看看