Question

我有以下json：

[
{
    "key": "Key-1",
    "field1": "hello",
    "field2": "world"
},
{

    "key": "Key-2",
    "field1": "hello",
    "field2": "world"
}
]

以及以下logstash文件：

input {
  http_poller {
    # List of urls to hit
    # URLs can either have a simple format for a get request
    # Or use more complex HTTP features
    urls => {
      myurl => {
        method => "GET"
        url => "http://localhost:8080/helloworld"
      }
    }
    # Decode the results as JSON
    codec => "json"
    # Schedule task
    schedule => { cron => "* * * * * UTC" }
  }

}

output {
  #debugging output

  stdout {
    codec => rubydebug
  }

  # elasticsearch output

  elasticsearch{
   hosts => "localhost"
   index => "helloworld"
  }

}

问题是此logstash使用相同的密钥创建多个文档，我希望logstash替换索引中的现有文档。无论如何我能做到吗？提前谢谢。

Answer 1

您应该定义文档的id，以便您可以根据密钥更新现有文件。

{{1}}

有关详细信息，请参阅文档here。

logstash提取json字段和覆盖索引

1 个答案: