我的logstash配置中有一个输出块,如下所示:
output {
elasticsearch {
hosts => ["elasticsearch.app:9200"]
healthcheck_path => "/"
flush_size => "500"
user => "user"
password => "password"
index => "%{[@metadata][index]}"
document_id => "%{[@metadata][id]}"
document_type => "%{[@metadata][type]}"
routing => "%{[@metadata][routing]}"
action => "%{[@metadata][action]}"
version => "%{[@metadata][version]}"
}
}
有时,要转向elasticsearch的索引项具有父级。如果我将一个父字段添加到我的配置elasticsearch,那么期望索引映射声明_parent。并非所有索引都可以。有没有更简洁的方法处理这个而不是使用IF块,并在条件的两侧几乎相同的配置?
像这样:output {
if [@metadata][parent] {
elasticsearch {
hosts => ["elasticsearch.app:9200"]
healthcheck_path => "/"
flush_size => "500"
user => "user"
password => "password"
index => "%{[@metadata][index]}"
document_id => "%{[@metadata][id]}"
document_type => "%{[@metadata][type]}"
routing => "%{[@metadata][routing]}"
action => "%{[@metadata][action]}"
version => "%{[@metadata][version]}"
parent => "%{[@metadata][parent]}"
}
} else {
elasticsearch {
hosts => ["elasticsearch.app:9200"]
healthcheck_path => "/"
flush_size => "500"
user => "user"
password => "password"
index => "%{[@metadata][index]}"
document_id => "%{[@metadata][id]}"
document_type => "%{[@metadata][type]}"
routing => "%{[@metadata][routing]}"
action => "%{[@metadata][action]}"
version => "%{[@metadata][version]}"
}
}
}
不是我最喜欢的解决方案。