Filter plugins ? mutate:-白红宇

Filter plugins ? mutate:

阅读量：5335 次

发布时间：2019-06-15

本文共 1803 字，大约阅读时间需要 6 分钟。

filter {    grok {        match => [             "message" , "\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
    
     (\S+))\?.*\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",              "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
     
      (\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",             "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
      
       (\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+\-\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",             "message","\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
       
        (\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+\-\s+(%{BASE16FLOAT:request_time})\s+(%{IPORHOST:remoteip}|-)"        ]    }           mutate {                        convert => [ "request_time", "float"]                       add_field =>["response_time","%{request_time}"]                        remove_field =>["request_time"]                       add_field => [ "[@metadata][zabbix_key]" , "logstash-api-access" ]                       add_field => [ "[@metadata][zabbix_host]" , "dr-mysql01" ]                        add_field =>["messager","%{type}-%{message}"]                         remove_field =>["message"]                }Filter plugins ? mutate:mutate 插件 允许你执行一般的mutations 在字段上,你可以rename, remove, replace, and modify fields in your events.简介:插件支持下下面的配置选项:需要的配置选项mutate {}