Here是我的logstash.conf
中的内容。
(不直接在此处粘贴内容的道歉。StackOverflow不允许代码与文本比率过高的问题。)
作为测试,我运行了PowerShell命令
C:\ Users \ Me \ Downloads \ curl-7.64.1-win64-mingw \ bin>。\ curl.exe -XPUT'http://127.0.0.1:31311/twitter_new/7'
我在Logstash终端上看到以下输出:
{
"message" => "",
"@version" => "1",
"host" => "127.0.0.1",
"@timestamp" => 2019-04-09T11:35:22.458Z,
"request_path_length" => 3,
"headers" => {
"http_host" => "127.0.0.1:31311",
"content_length" => "0",
"request_path" => [
[0] "",
[1] "twitter_new",
[2] "7"
],
"http_accept" => "*/*",
"http_version" => "HTTP/1.1",
"http_user_agent" => "curl/7.64.1",
"request_method" => "PUT"
},
"index_id" => "twitter_new"
}
如您所见,document_id
并未设置为7
,即使这是我所期望的。
我该如何解决?
更新:
我改变了
if [request_path_length == 3] {
到
if [request_path_length] == 3 {
我又向PUT
发送了一个/twitter_new/8
请求。然后,我发出了一个GET
请求以检索所有条目,而这是与我最近进行的PUT
请求相对应的条目:
{
"_index": "twitter_new",
"_type": "doc",
"_id": "O5AIAmoBCWsefMj-o7Fw",
"_score": 1,
"_source": {
"message": "",
"document_id": "8",
"@version": "1",
"@timestamp": "2019-04-09T12:18:00.665Z",
"index_id": "twitter_new",
"request_path_length": 3,
"headers": {
"request_path": [
"",
"twitter_new",
"8"
],
"http_accept": "*/*",
"http_version": "HTTP/1.1",
"content_length": "0",
"request_method": "PUT",
"http_user_agent": "curl/7.64.1",
"http_host": "127.0.0.1:31311"
},
"host": "127.0.0.1"
}
}
如您所见,在source
中,document_id
确实设置为8
,但是_id
仍然是随机生成的字符串。我希望_id
也将是8
,就像_index
是twitter_new
一样。
我误会了吗?
答案 0 :(得分:2)
您需要更改条件。
这是引用logstash管道上的字段的正确方法:
if [request_path_length] == 3
您正在使用if [request_path_length == 3]
,它不起作用。