Question

我的Logstash配置中的动态字段名称有问题。这是我的测试配置：

input {
generator {
    lines => [ "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
                "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version" ]
    count => 7
}
}
filter {
   grok {
     match => [ "message", "%{SYSLOGBASE} %{WORD:log}.*" ]
   }

        if "Starting" in [log] {
        metrics {
          meter => [ "%{logsource}.%{log}" ]
          add_tag => [ "metric" ]
          add_field => { "server" => "%{logsource}" 
                        "bad" => "true" }
          clear_interval => 5
                }
       }
}
output {
        stdout { codec => rubydebug }
}

这是我的输出:(刚刚输出结束）

{
       "message" => "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 15 13:42:55",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Finished"
}
{
       "message" => "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 16 14:57:07",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Starting"
}
{
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.288Z",
       "message" => "Counting: 7",
      "logstash.Starting" => {
           "count" => 7,
         "rate_1m" => 0.0,
         "rate_5m" => 0.0,
        "rate_15m" => 0.0
    },
        "server" => "%{logsource}",
           "bad" => "true",
          "tags" => [
        [0] "metric"
    ]
}

为什么字段服务器没有 logstash 作为输入日志的值？ ％{logsource} 适用于米选项，为什么不选择 add_field ？求助。

Answer 1

收到日志事件时，将从内容中提取SYSLOGBASE信息。这是定义％{logsource}值的位置。如果事件不是来自包含SYSLOGBASE信息的日志条目，则logsource将是未定义的。

当您收到开始消息时，logsource在范围内定义并添加到您的消息中。

metrics插件每个时间间隔生成一条新消息。此消息是从头开始生成的，因此它没有logsource的值或通常从单个日志条目中获取的任何其他内容。

logstash - 动态字段名称

1 个答案: