logstash -动态字段名

Question

我对Logstash配置中的动态字段名有问题。这是我的测试配置：

input {
generator {
    lines => [ "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
                "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version" ]
    count => 7
}
}
filter {
   grok {
     match => [ "message", "%{SYSLOGBASE} %{WORD:log}.*" ]
   }

        if "Starting" in [log] {
        metrics {
          meter => [ "%{logsource}.%{log}" ]
          add_tag => [ "metric" ]
          add_field => { "server" => "%{logsource}" 
                        "bad" => "true" }
          clear_interval => 5
                }
       }
}
output {
        stdout { codec => rubydebug }
}

这是我的输出：(输出的末尾)

{
       "message" => "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 15 13:42:55",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Finished"
}
{
       "message" => "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 16 14:57:07",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Starting"
}
{
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.288Z",
       "message" => "Counting: 7",
      "logstash.Starting" => {
           "count" => 7,
         "rate_1m" => 0.0,
         "rate_5m" => 0.0,
        "rate_15m" => 0.0
    },
        "server" => "%{logsource}",
           "bad" => "true",
          "tags" => [
        [0] "metric"
    ]
}

为什么字段服务器没有从输入日志中的logstash作为值？%{logsource}为米选项工作，那么为什么不对add_field呢？寻求帮助。

Answer 1

当收到日志事件时，从内容中提取SYSLOGBASE信息。这里定义%{logsource}值。如果事件不是来自包含SYSLOGBASE信息的日志条目，则日志源将未定义。

当收到开始消息时，将在作用域中定义日志源，并将其添加到邮件中。

度量插件每隔一段时间生成一条新消息。此消息是从零开始生成的，因此它没有日志源的值或其他通常从单个日志条目获得的内容。