从logstash

时间:2017-10-04 11:24:36

标签: elasticsearch amazon-s3 logstash

我有一个s3存储桶,我从中获取CSV文件并上传到ES。 我被困在如何获取我在s3中的文件名,因为我使用s3文件名作为索引名称。 我的配置文件 -

input{
    s3{
    bucket => "***"
    access_key_id => "**"
    secret_access_key => "***"
    region => "**"

}
}

filter {
    csv {
        separator => ","
        columns  => [ "name","uid","startdate","enddate"]

    }
    mutate {convert =>[uid , "integer"]}

      date {
      match => [ "startdate", "ISO8601", "YYYY/MM/dd HH:mm:ss","YYYY/MM/dd HH:mm" ]
      target => "startdate"
      locale => "en"
      timezone => "Asia/Dubai"
    }

      date {
      match => [ "enddate", "ISO8601", "YYYY/MM/dd HH:mm","YYYY/MM/dd HH:mm:s" ]
      target => "enddate"
      locale => "en"
      timezone => "Asia/Dubai"
    }
      mutate {
    add_field => {
      "index_name" => "%{[@metadata][s3][key]}"
    }

  }

  }

output {
    elasticsearch {
        hosts => "localhost"
        index => "%{index_name}"
    }
    stdout{}

}

0 个答案:

没有答案