我正在尝试编写Logstash配置文件。我有几个input
。我试过这样,但它不起作用。
input {
file {
type => "log"
#...file from somewhere...
}
file {
type => "log"
#...file from another place...
}
file {
type => "event"
#...other settings...
}
}
filter {
if [type] == "log" {
#...find comment patterns and drop it here...
grok {
match => { "message" => "...patterns here..." }
}
#...finally do some mutations here...
}
}
output {
stdout {
codec => "rubydebug"
}
}
当我评论if [type] == "log"
时,它运行正常。如何仅在类型匹配时过滤消息?