ELK——Logstash 2.2 mutate 插件【翻譯+實踐】

時間  2019-11-06
標籤 elk logstash 2.2 mutate 插件 翻譯+實踐 欄目 日誌分析 简体版
原文   原文鏈接

官網地址css

本文內容

  • 語法
  • 測試數據
  • 可選配置項

mutate 插件能夠在字段上執行變換，包括重命名、刪除、替換和修改。這個插件至關經常使用。html

好比：jquery

  • 你已經根據 Grok 表達式將 Tomcat 日誌的內容放到各個字段中，想把狀態碼、字節大小或是響應時間，轉換成整型；
  • 你已經根據正則表達式將日誌內容放到各個字段中，可是字段的值，大小寫都有，這對於 Elasticsearch 的全文檢索來講，顯然用處不大，那麼能夠用該插件，將字段內容所有轉換成小寫。

遷移到：http://www.bdata-cap.com/newsinfo/1712678.html

語法

該插件必須是用 mutate 包裹，以下所示：正則表達式

mutate {}

可用的配置選項以下表所示：apache

設置 輸入類型 是否必填 默認值
add_field hash No {}
add_tag array No []
convert hash No  
gsub array No  
join hash No  
lowercase array No  
merge hash No  
periodic_flush boolean No false
remove_field array No []
remove_tag array No []
rename hash No  
replace hash No  
split hash No  
strip array No  
update hash No  
uppercase array No  

其中，add_field、remove_field、add_tag、remove_tag 是全部 Logstash 插件都有。它們在插件過濾成功後生效。雖然 Logstash 叫過濾，但不只僅過濾功能。數組

tag 做用是，當你對字段處理期間，還指望進行後續處理，就先做個標記。Logstash 有個內置 tags 數組，包含了期間產生的 tag，不管是 Logstash 本身產生的，仍是你添加的，好比，你用 grok 解析日誌，可是錯了，那麼 Logstash 本身就會本身添加一個 _grokparsefailure 的 tag。這樣，你在 output 時，能夠對解析失敗的日誌不作任何處理；ruby

而 field 做用是，對字段的操做，好比，你想利用已有的字段，建立新的字段。這些在後面再說。app

另外，你會發現，上表中全部選項，要麼是動詞，要麼是動賓短語。估計你也猜到了，選項其實就是 ruby 函數，而它們後面，即「=>」，跟着的確定是一堆參數（要是你寫程序，你也會這麼幹）。第一個參數，確定是字段，也就是你指望該函數做用在哪一個字段上，從第二個字段開始日後，是具體參數~ide

什麼是字段？好比，你想解析 Tomcat 日誌，把一行訪問日誌拆分後，獲得客戶端IP、字節大小、響應時間等放到指定變量，那麼這個變量就是字段。函數

下面具體介紹各個選項。

測試數據

 

 

假設有 Tomcat access 日誌：

192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET "/goLogin" "" 8080 200 1692 23 "http://10.1.8.193:8080/goMain" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"
192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET "/js/common/jquery-1.10.2.min.js" "" 8080 304 - 67 "http://10.1.8.193:8080/goLogin" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"
192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET "/css/common/login.css" "" 8080 304 - 75 "http://10.1.8.193:8080/goLogin" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"
192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET "/js/system/login.js" "" 8080 304 - 53 "http://10.1.8.193:8080/goLogin" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0"

它是按以下 Tomcat 配置產生的：

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="localhost_access_log." suffix=".txt"
               pattern="%h %l %u %t %m &quot;%U&quot; &quot;%q&quot; %p %s %b %D &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;" />

若用以下 Grok 表達式解析該日誌：

%{IPORHOST:clientip} %{NOTSPACE:identd} %{NOTSPACE:auth} \[%{HTTPDATE:timestamp}\] %{WORD:http_method} %{NOTSPACE:request} %{NOTSPACE:request_query|-} %{NUMBER:port} %{NUMBER:statusCode} (%{NOTSPACE:bytes}|-) %{NUMBER:reqTime} %{QS:referer} %{QS:userAgent}

會獲得以下結果：

{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T08:26:07.794Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

注意，日誌拆分到各個字段後的數據類型。port、statusCode、bytes、reqTime 字段確定是（最好是）數字，不過這裏暫時先用字符串。後面會介紹，下面的示例都在此基礎上。

可配置選項

add_field

  • 值是散列，就是鍵值對，好比 add_field => {"field1"=>"value1","field2"=>"value2"}。
  • 默認值是空對象，即 {}

添加新的字段。

示例：

input {
        stdin {
        }
}
filter {
        grok {
                match=>["message","%{IPORHOST:clientip} %{NOTSPACE:identd} %{NOTSPACE:auth} \[%{HTTPDATE:timestamp}\] %{WORD:http_method} %{NOTSPACE:request} %{NOTSPACE:request_query|-} %{NUMBER:port} %{NUMBER:statusCode} (%{NOTSPACE:bytes}|-) %{NUMBER:reqTime} %{QS:referer} %{QS:userAgent}"]
        }
        mutate {
                add_field=>{
                         "SayHi"=>"Hello , %{clientip}"
                }
        }
}
output{
        stdout{
                codec=>rubydebug
        }
}
注意黑體部分，若是用這個配置，解析前面的 Tcomat access 日誌，會獲得以下結果：
{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T04:52:02.031Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
            "SayHi" => "Hello , 192.168.6.25"
}
你會看到多了一個 SayHi 字段。這個字段是寫死的，固然也能夠動態。若是將
"SayHi"=>"Hello , %{clientip}"
改爲：
"another_%{clientip}"=>"Hello , %{clientip}" 
你會看到以下結果：
{
                 "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
                "@version" => "1",
              "@timestamp" => "2016-05-17T06:38:04.427Z",
                    "host" => "vcyber",
                "clientip" => "192.168.6.25",
                  "identd" => "-",
                    "auth" => "-",
               "timestamp" => "24/Apr/2016:01:25:53 +0800",
             "http_method" => "GET",
                 "request" => "\"/goLogin\"",
           "request_query" => "\"\"",
                    "port" => "8080",
              "statusCode" => "200",
                   "bytes" => "1692",
                 "reqTime" => "23",
                 "referer" => "\"http://10.1.8.193:8080/goMain\"",
               "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
    "another_192.168.6.25" => "Hello , 192.168.6.25"
}

雖然這個例子不太合理，但你如今知道，用已有字段的值，能夠生成新的字段和它的值。上面示例只添加了一個字段，你也能夠添加多個字段：

add_field=>{
        "another_%{clientip}"=>"Hello , %{clientip}"
        "another_%{http_method}"=>"Hello, %{http_method}"
}

add_tag

  • 值是 array 數組
  • 默認值爲空數組，即 []

添加新的標籤。

示例：

mutate {
        add_tag=>[
                "foo_%{clientip}"
        ]
}
你會看到以下結果：
{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T06:48:43.278Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
             "tags" => [
        [0] "foo_192.168.6.25"
    ]
}
與 add_field 相似，也能夠一次添加多個 tags。
注意，add_tag 是數組 []，不是 {}。

convert

  • 值是 hash
  • 無默認值

數據類型轉換。

若是要轉換成 boolean，那麼可接受的數據是：

  • true, t, yes, y, 和 1
  • false, f, no, n, 和 0

另外，還可轉換成 integer, float, string。

示例：

mutate {
        #convert=>["reqTime","integer","statusCode","integer","bytes","integer"]
        convert=>{"port"=>"integer"}
}

convert 有兩種寫法。一種是用數組，兩個爲一組；另外一種是散列。獲得以下結果：

{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T09:06:25.360Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => 8080,
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

注意，

  • port 字段，已經沒有雙引號啦。
  • mutate 插件選項的值類型設計得很簡單，要麼是散列（鍵值對），要麼數組……好比，convert=>["reqTime","integer","statusCode","integer"]，兩個爲一組，第一個表示字段，第二個爲想轉換的數據類型，並無採用嵌套或是複合類型。看來做者的意圖是——簡單，複雜的數據類型，雖然看起來容易，但要付出成本的。簡單不要緊，約定好就行。Logstash 不少插件和其選項都這樣。

gsub

  • 值是 array 數組
  • 無默認值

字符串替換。用正則表達式和字符串都行。它只能用於字符串，若是不是字符串，那麼什麼都不會作，也不會報錯。

該配置的值是數組，三個爲一組，分別表示：字段名稱，待匹配的字符串（或正則表達式），待替換的字符串。

示例：在解析 Tomcat 日誌，會遇到一種狀況，資源的字節大小，可能會是「-」，所以，須要將「-」，替換成0，而後在用convert轉換成數字型。

input {
        stdin {
        }       
}
filter {
        grok {
                match=>["message","%{IPORHOST:clientip} %{NOTSPACE:identd} %{NOTSPACE:auth} \[%{HTTPDATE:timestamp}\] %{WORD:http_method} %{NOTSPACE:request} %{NOTSPACE:request_query|-} %{NUMBER:port} %{NUMBER:statusCode} (%{NOTSPACE:bytes}|-) %{NUMBER:reqTime} %{QS:referer} %{QS:userAgent}"]
        }
        mutate {
                gsub=>["bytes","_","0"]
                convert=>["port","integer","reqTime","integer","statusCode","integer","bytes","integer"]
        }
}
output{
        stdout{
                codec=>rubydebug
        }
}

獲得以下結果：

{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/js/common/jquery-1.10.2.min.js\" \"\" 8080 304 - 67 \"http://10.1.8.193:8080/goLogin\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T09:17:21.745Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/js/common/jquery-1.10.2.min.js\"",
    "request_query" => "\"\"",
             "port" => 8080,
       "statusCode" => 304,
            "bytes" => 0,
          "reqTime" => 67,
          "referer" => "\"http://10.1.8.193:8080/goLogin\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

join

  • 值是 hash
  • 無默認值

用分隔符鏈接數組. 若是字段不是數組，那什麼都不作。

示例：

filter {
  mutate {
    join =>{"fieldname"=>","}}}

lowercase 和 uppercase

  • 值是數組 array
  • 沒有默認值

把字符串轉換成小寫或大寫。

示例：

filter {
  mutate {
    lowercase =>["fieldname"]}}

示例：

filter {
  mutate {
    uppercase =>["fieldname"]}}

merge

  • 值是 hash
  • 無默認值

合併兩個數組或散列字段。存在三種狀況，合併後是數組：

  • 數組和字符串，能夠合併
  • 字符串和字符串，能夠合併
  • 數組和散列不能合併

示例：

mutate {
        add_field=>{"arr_clientip"=>"%{clientip}"}
        add_field=>{"arrmstr_clientip"=>"%{clientip}"}
        add_field=>{"arrmarr_clientip"=>"%{clientip}"}
        #merge=>{"merge_clientip"=>"clientip"}
}
mutate {
        split=>{"arr_clientip"=>"."}
        split=>{"arrmstr_clientip"=>"."}
        split=>{"arrmarr_clientip"=>"."}
}
mutate {
        merge=>{"arrmstr_clientip"=>"clientip"}
        merge=>{"arrmarr_clientip"=>"arr_clientip"}
}
=> 後面的字段值會合併到前面的字段。
獲得以下結果：
{
             "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
            "@version" => "1",
          "@timestamp" => "2016-05-18T02:53:35.671Z",
                "host" => "vcyber",
            "clientip" => "192.168.6.25",
              "identd" => "-",
                "auth" => "-",
           "timestamp" => "24/Apr/2016:01:25:53 +0800",
         "http_method" => "GET",
             "request" => "\"/goLogin\"",
       "request_query" => "\"\"",
                "port" => "8080",
          "statusCode" => "200",
               "bytes" => "1692",
             "reqTime" => "23",
             "referer" => "\"http://10.1.8.193:8080/goMain\"",
           "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
        "arr_clientip" => [
        [0] "192",
        [1] "168",
        [2] "6",
        [3] "25"
    ],
    "arrmstr_clientip" => [
        [0] "192",
        [1] "168",
        [2] "6",
        [3] "25",
        [4] "192.168.6.25"
    ],
    "arrmarr_clientip" => [
        [0] "192",
        [1] "168",
        [2] "6",
        [3] "25",
        [4] "192",
        [5] "168",
        [6] "6",
        [7] "25"
    ]
}

periodic_flush

  • 值是 boolean
  • 默認值是 false

按時間間隔調用。可選。

remove_field

  • 值是數組 array
  • 默認值是數組 []

移除字段。

示例：移除 message 字段。

mutate {
        remove_field=>["message"]
}

獲得以下結果：

{
         "@version" => "1",
       "@timestamp" => "2016-05-18T02:04:16.879Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

message 字段已經沒有了~message 字段保存了原始日誌，若是保留的話，就意味着日誌存了兩份：分割前和分割後。

固然，也能夠一次移除多個字段。

remove_tag

  • 值是數組 array
  • 默認值是 []

移除標識。

示例：

filter {
  mutate {
    remove_tag =>["foo_%{somefield}"]}}

也能夠一次移動多個 tag：

filter {
  mutate {
    remove_tag =>["foo_%{somefield}","sad_unwanted_tag"]}}

rename

  • 值是 hash
  • 無默認值

重命名一個或多個字段。

示例:

input {
        stdin {
        }       
}
filter {
        grok {
                match=>["message","%{IPORHOST:clientip} %{NOTSPACE:identd} %{NOTSPACE:auth} \[%{HTTPDATE:timestamp}\] %{WORD:http_method} %{NOTSPACE:request} %{NOTSPACE:request_query|-} %{NUMBER:port} %{NUMBER:statusCode} (%{NOTSPACE:bytes}|-) %{NUMBER:reqTime} %{QS:referer} %{QS:userAgent}"]
        }
        mutate {
                rename=>{"clientip"=>"host"}
        }
}
output{
        stdout{
                codec=>rubydebug
        }
}

獲得以下結果：

{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-17T09:29:44.018Z",
             "host" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

Grok 裏，客戶端IP原本叫 clientip，可是能夠在 mutate 裏從新命名爲 host。

replace

  • 值是 hash
  • 無默認值

用一個新的值替換掉指定字段的值。

示例：

input {
        stdin {
        }       
}
filter {
        grok {
                match=>["message","%{IPORHOST:clientip} %{NOTSPACE:identd} %{NOTSPACE:auth} \[%{HTTPDATE:timestamp}\] %{WORD:http_method} %{NOTSPACE:request} %{NOTSPACE:request_query|-} %{NUMBER:port} %{NUMBER:statusCode} (%{NOTSPACE:bytes}|-) %{NUMBER:reqTime} %{QS:referer} %{QS:userAgent}"]
        }
        mutate {
                replace=>{"message"=>"%{clientip}: My new Message."}
        }
}
output{
        stdout{
                codec=>rubydebug
        }
}

獲得以下結果：

{
          "message" => "192.168.6.25: My new Message.",
         "@version" => "1",
       "@timestamp" => "2016-05-18T01:55:34.566Z",
             "host" => "vcyber",
         "clientip" => "192.168.6.25",
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

message 字段的值已經變了。

split

  • 值是 hash
  • 無默認值

用分隔符或字符分割一個字符串。只能應用在字符串上。

示例：把客戶端IP按英文句號分割成數組。

mutate {
        split=>{"clientip"=>"."}
}
獲得以下結果：
{
          "message" => "192.168.6.25 - - [24/Apr/2016:01:25:53 +0800] GET \"/goLogin\" \"\" 8080 200 1692 23 \"http://10.1.8.193:8080/goMain\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\"",
         "@version" => "1",
       "@timestamp" => "2016-05-18T01:58:40.687Z",
             "host" => "vcyber",
         "clientip" => [
        [0] "192",
        [1] "168",
        [2] "6",
        [3] "25"
    ],
           "identd" => "-",
             "auth" => "-",
        "timestamp" => "24/Apr/2016:01:25:53 +0800",
      "http_method" => "GET",
          "request" => "\"/goLogin\"",
    "request_query" => "\"\"",
             "port" => "8080",
       "statusCode" => "200",
            "bytes" => "1692",
          "reqTime" => "23",
          "referer" => "\"http://10.1.8.193:8080/goMain\"",
        "userAgent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}

strip

  • 值是數組 array
  • 無默認值

去掉字段首尾的空格。

示例：

filter {
  mutate {
     strip =>["field1","field2"]}}

update

  • 值是 hash
  • 無默認值

Update an existing field with a new value. If the field does not exist, then no action will be taken.

示例：

filter {
  mutate {
    update =>{"sample"=>"My new message"}}}
相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程