在Logstash文件中的“字段”中更改特定的“值”

Question

我希望在logstash文件字段中更改一个值。

对于我的情况，我的logstash配置文件是这样的..

# Read input from filebeat by listening to port 5044 on which filebeat will send the data
input {
    beats {
        port => "5044"
    }
}

filter {
    ######################################### For Solr ############################################## 
    if "solr" in [log][file][path] {
        grok {
            match => {"message" => "%{DATA:timestamp}%{SPACE}%{LOGLEVEL:log-level}%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## For Server ############################################## 
    if "server.log" in [log][file][path] {
        grok {
            match => {"message" => "%{DATA:timestamp}%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA}\]%{SPACE}\(%{DATA:thread}\)%{SPACE}%{GREEDYDATA:log-message}"}
            #match => { "[log][file][path]" => "%{GREEDYDATA}/%{GREEDYDATA:jboss-log}.log"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        } 
        
    }
    
    ############################################## For Mongo ############################################## 
    else if "mongos" in [log][file][path] or "config" in [log][file][path] or "shard" in [log][file][path] or "metrics_" in [log][file][path]{
        grok {
            match => {"message" => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    ############################################## For mongo.log #####################################################
    else if "mongo" in [log][file][path] {
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    ############################################## For Kafka ############################################## 
    else if "kafka" in [log][file][path] {
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## For mongodb_output & mongodb_exception ############################################## 
    else if "mongodb_exception" in [log][file][path] or "mongodb_output" in [log][file][path]{
        grok {
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
    
    ############################################## Other Logs ##############################################
    else {
        grok {
            #match => {"message" => "\[%{MONTHDAY:day}%{SPACE}%{MONTH:month}%{SPACE}%{YEAR:year},%{SPACE}%{TIME:time}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]\[%{DATA:thread}\]%{SPACE}%{GREEDYDATA:log-message}"}
            match => {"message" => "\[%{DATA:timestamp}\]%{SPACE}%{LOGLEVEL:log-level}%{SPACE}\[%{DATA:class}\]\[%{DATA:thread}\]%{SPACE}%{GREEDYDATA:log-message}"}
            #remove_field => ["message"]
            #add_field => {"message" => "%{log-message}"}
        }
    }
   
   
   
   ################################################################
   
   grok {
        match => { "[log][file][path]" => ["%{GREEDYDATA}/%{GREEDYDATA:component}.log" , "%{PATH}\\%{GREEDYDATA:component}\_%{GREEDYDATA}.log" ]}
   }
   
   if [component] =~ "^server" {
        mutate {
            rename => { "%{server}" => "renamed_server" }
        }   
   }
       
} 

output {
    
    # sending properly parsed log events to elasticsearch
    elasticsearch {
            hosts => ["localhost:9200"]
    }
}

我将获得component字段的server值，但我希望将component字段server的值更改为renamed_server。

我已经试过了，但是我没有得到任何输出。

请帮我找出所需的解决方案。

Answer 1

我想问题是这个街区：

if [component] =~ "^server" {
  mutate {
    rename => { "%{server}" => "renamed_server" }
  }   
}

。。因为它做不到你想做的事。

我希望将组件字段服务器的值更改为renamed_server。

rename变异配置不会改变值，而是重命名字段。

如果要更改值，可以使用gsub。既然你想要改变确切的值，也许你可以完全不带条件地度过难关。例如：

    mutate {
      gsub => [
        # replace `server` value with `renamed_server` in component field
        "component", "^server$", "renamed_server"
      ]
    }

Answer 2

我用gsub修改了这个字段，它也起作用了。

mutate {
        gsub => [
            "component", "^server$", "renamed_server",
            "component", "^[0-9]{3}.*[0-9]{3}.*[0-9]{2}.*[0-9]{2}.*[0-9]{5}.*output$" , "client_output"
        ]
}