Scenario | Logstash | Data Processing | |
rename field | mutate | mutate { rename => {"old_field_name" => "new_field_name" } } | |
Delete Field | | mutate { remove_field => ["password_hash"] } | |
update field value | | mutate { update => {"status_code" => "Not Found" status_code":"Not Found | |
extract key-value pairs - Grok | grok | grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:level} " }} | |
extract key-value pairs - Separator | split | mutate { split => { "message" => "|" } add_field => { "time" => "%{[message][0]}" "level" => "%{[message][1]}" "taskId" => "%{[message][2]}" "ProcessName" => "%{[message][3]}" "ip" => "%{[message][4]}" } remove_field => ["message"] } | fields_drop("message") |
extract key-value pairs - JSON | json | json { source => "message" target => "parsed_data" } | |
Delete log | drop | if [status] == 404 { //if status=404 Delete log } | ) |
Logical judgment | if else | if [log] //if the log field exists if "Cost" in [message] //when the message field contains "Cost" | t_if ( if "Cost" in [message] //when the message field contains "Cost" |
| or , and | if "Cost" in [message] or "cost" in [message] | str_exist(v(message), "cost", ignore_upper=False) ) |
Distribute logs to multiple sinks (target) | output | if [container] == "scm-pfc" { elasticsearch { hosts => ["xx.xx.x.xxx:9200"] index => "p-k8s" } } else { elasticsearch { hosts => ["xx.xx.x.xx:9200"] index => "p-container" }} | op_str_eq(v("container"),"scm-pfc"), log_output("p-container") //else branch ) |
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback