我的logstash conf中有一个grok过滤器。在匹配消息的地方,我想添加一个新字段 newfield ,并从消息中的一个特定字段 data1 填充值。这是我的配置:
input {
file {
path => "/var/log/myapp/myapp.log"
sincedb_path => "/var/log/logstash/.sincedb2/myapp.log"
start_position => beginning
type => "myapp"
}
}
filter {
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:loglevel}\s+%{JAVACLASS:class}:\s+%{WORD:word1}\s+%{WORD:word2}:\s+%{WORD:word3}=%{DATA:data1}+%{GREEDYDATA:content}"
}
}
mutate {
add_field => [ "newfield", "%{data1}" ]
}
if ("grokparsefailure" in [tags]) { drop {} }
}
output {
if [type] == "myapp"{
elasticsearch {
hosts => [{% for node in elastic_data_hosts %}"{{node}}:{{elastic_port}}"{% if not loop.last %},{% endif %}{% endfor %}]
index => "logstash-myapp-log"
}
}
}
我可以看到在Kibana上添加了新字段,但是未分配该值。我做错了什么还是错过了什么?
答案 0 :(得分:0)
请尝试使用[]
代替{}
,如示例here所示。
mutate {
add_field => { "foo" => "Hello world, from %{host}" }
}