Question

我正在尝试通过logstash将一个csv文件输入到elasticsearch。

这是我的配置文件

input {
  file {
    codec => plain{
    charset => "ISO-8859-1"
    }
    path => ["PATH/*.csv"]
    sincedb_path => "PATH/.sincedb_path"
    start_position => "beginning"
  }
}
filter {

    if [message] =~ /^"ID","DATE"/ {
    drop { }
    }
  date {
    match => [ "DATE","yyyy-MM-dd HH:mm:ss" ]
    target => "DATE"
  }
    csv {
    columns => ["ID","DATE",...]
    separator => ","
    source => message
    remove_field => ["message","host","path","@version","@timestamp"]
  }
}

output {

     elasticsearch {
    embedded => false
    host => "localhost"
    cluster => "elasticsearch"
    node_name => "localhost"
    index => "index"
    index_type => "type"
  }
}

现在，elasticsearch中生成的映射将DATE字段键入为字符串。我想输入日期字段。

在filter元素中，我尝试在日期中转换类型字段，但它不起作用。

我该如何解决？

此致亚历山大

Answer 1

您的过滤器链设置顺序错误。 date{}阻止需要在csv {}阻止之后。

如何在logstash中键入数据输入

1 个答案: