Question

尝试解析和在另一个字段中使用geoip.asn值，如下所示：

   geoip {
    default_database_type => "ASN"
    source => "dst"
   }

   mutate {
    add_field => { "[dst_asn]" => "%{[geoip][asn]}" }
    # remove_field => [ "geoip" ]
   }

这是我各自的索引模板字段声明：

"dst_asn": {"type": "integer"},

但是，对于一些值，出现以下错误：

[2018-11-07T14:19:17,716][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"my_index_raw_data-2018.11.07", :_type=>"_doc", :_routing=>nil}, #<LogStash::Event:0x5c30a50a>], :response=>{"index"=>{"_index"=>"my_index_raw_data-2018.11.07", "_type"=>"_doc", "_id"=>"Kcsc7mYBo99I6PWl0CVS", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [dst_asn]", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: \"%{[geoip][asn]}\""}}}}}

_

# sudo dpkg -s logstash
Package: logstash
Status: install ok installed
Priority: extra
Section: default
Installed-Size: 253337
Maintainer: <vagrant@packer-virtualbox-iso-1522340558>
Architecture: all
Version: 1:6.4.2-1
Conffiles:
 /etc/logstash/jvm.options 762ae825205c9b1b2716093895b25022
 /etc/logstash/log4j2.properties cf74034ff061d473fee9dc1c7eb07d16
 /etc/logstash/logstash-sample.conf 4ef421e7ee74e023c9b07f200cc6010a
 /etc/logstash/logstash.yml 41cb35d7b75bf4b76215b1ad393e6a5c
 /etc/logstash/pipelines.yml f4fec5524ff51ccd6a5e7f686cb8c3f5
 /etc/logstash/startup.options 63ffc442d4f1c1a56c178a1d8af85eb0
Description: An extensible logging pipeline
License: Elastic-License
Vendor: Elasticsearch
Homepage: http://www.elasticsearch.org/overview/logstash/

root@atlantis-server:/usr/share/logstash# bin/logstash-plugin list --verbose | grep geoip
logstash-filter-geoip (5.0.3)

Answer 1

add_field定义不正确，应该像这样：

add_field => { "[dst_asn]" => "%{[geoip][asn]}" }

Logstash / Elasticsearch：geoip.asn值的数字格式异常

1 个答案: