filter { grok { match => [ "message" , "s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))?.*s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+ %{NUMBER:bytes}s+(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}", "message" ,"s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+%{NUMBER:bytes}s +(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}", "message" ,"s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+-s +(%{BASE16FLOAT:request_time})s+%{IPORHOST:remoteip}", "message","s*%{IPORHOST:clientip}s+-s+-s+[%{HTTPDATE:time}]s+"%{WORD:verb}s+(?<api>(S+))s+HTTP/%{NUMBER:httpversion}"s+%{NUMBER:http_status_code}s+-s +(%{BASE16FLOAT:request_time})s+(%{IPORHOST:remoteip}|-)" ] } mutate { convert => [ "request_time", "float"] add_field =>["response_time","%{request_time}"] remove_field =>["request_time"] add_field => [ "[@metadata][zabbix_key]" , "logstash-api-access" ] add_field => [ "[@metadata][zabbix_host]" , "dr-mysql01" ] add_field =>["messager","%{type}-%{message}"] remove_field =>["message"] } Filter plugins ? mutate: mutate 插件 允许你执行一般的mutations 在字段上,你可以rename, remove, replace, and modify fields in your events. 简介: 插件支持下下面的配置选项: 需要的配置选项 mutate { }