如何使用Logstash过滤器突变删除字段

时间:2018-07-21 03:07:08

标签: logstash

我的logstash输入是:

2018-07-21T02:45:51.620Z %{host} {"@timestamp":"2018-07-21T02:45:46.561Z","beat":{"hostname":"es-234","name":"es-234","version":"5.6.5"},"input_type":"log","message":"hello","offset":2777,"source":"/opt/filebeat-5.6.5-linux-x86_64/logs/zhou.log","type":"log"}
2018-07-21T02:45:51.620Z %{host} {"@timestamp":"2018-07-21T02:45:46.561Z","beat":{"hostname":"es-234","name":"es-234","version":"5.6.5"},"input_type":"log","message":"hello","offset":2765,"source":"/opt/filebeat-5.6.5-linux-x86_64/logs/zhou.log","type":"log"}

我的logstash配置为:

filter {
    mutate {

            remove_field => [ "@timestamp","beat" ]
    }

}

我要删除文件“ @tamestamp”和“ beat”,但失败了,请帮助我

0 个答案:

没有答案