Logstash重命名特定字段？

Question

我这样的日志很慢......

[2017-01-13 14:37:48,943][DEBUG][index.search.slowlog.query] [Spectra] [test][4] took[50micros], took_millis[0], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], 
[2017-01-13 12:58:09,844][WARN ][index.search.slowlog.query] [Spectra] [testindex-stats][1] took[16.2ms], took_millis[16], types[], stats[], search_type[QUERY_THEN_FETCH],

我需要重命名[50micros]以在所有慢速日志中使用[50ms]。我怎样才能使用logstash实现这一目标？

Answer 1

使用gsub过滤器

工作正常

 mutate {
     gsub => [

      "TOOK", "micros", "ms"
    ]
}