如何按输入类型过滤?

时间:2015-06-01 14:56:06

标签: logstash

我正在尝试编写Logstash配置文件。我有几个input。我试过这样,但它不起作用。

input {
    file {
         type => "log"
         #...file from somewhere...
    }
    file {
         type => "log"
         #...file from another place...
    }
    file {
         type => "event"
         #...other settings...
    }
}

filter {
    if [type] == "log" {

        #...find comment patterns and drop it here...

        grok {
            match => { "message" => "...patterns here..." }
        }

        #...finally do some mutations here...

    }
}

output {
    stdout {
        codec => "rubydebug"
    }
}

当我评论if [type] == "log"时,它运行正常。如何仅在类型匹配时过滤消息?

0 个答案:

没有答案