這是我的作業 logstash 配置
output {
if[@metadata][pipeline] {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{ YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
user => some_user
password => pass_4_some_user
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index =>"%{[@metadata][beat]}-%{[@metadata][version]}-%{ YYYY.MM.dd}"
user => some_user
password => pass_4_some_user
}
}
}
我需要檔案路徑是否相等/file/path索引必須是test_file_index-%{ YYYY.MM.dd}
我的新組態檔
output {
if "/file/path" in [@file][path] {
elasticsearch {
hosts => ["localhost:9200"]
index =>"test_file_index-%{ YYYY.MM.dd}"
user => some_user
password => pass_4_some_user
}
} else {
if[@metadata][pipeline] {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{ YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
user => some_user
password => pass_4_some_user
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index =>"%{[@metadata][beat]}-%{[@metadata][version]}-%{ YYYY.MM.dd}"
user => some_user
password => pass_4_some_user
}
}
}
}
作業不正常。如果有人知道什么是正確的方法
uj5u.com熱心網友回復：
我相信條件應該是
if "/file/path" in [path] {
由于檔案輸入將檔案路徑存盤在path欄位中，而不是@file.path
uj5u.com熱心網友回復：
output {
if [log][file][path] == "/full/file/path" {
elasticsearch {
hosts => ["localhost:9200"]
...
這個對我有用。如果有人關心)))
轉載請註明出處，本文鏈接：https://www.uj5u.com/net/366904.html