Logstash匹配多个值

Question

1）这是我的logstash.conf文件

input {
  beats {
    type => beats
    port => 5044
  }
}

filter {
  grok {
    match => { "message" => "\[(?<logtime>([0-9]|[\-\+\.\:\ ])*)\] \[(?<level>([a-z-A-Z])*)\] \[(?<msg>(.)+)\] (?<exception>(.)+)" }
  }
  mutate {
    add_field => [ "logtime", "level", "msg", "exception" ]
    remove_field => [ "beat", "offset", "source", "prospector", "host", "tags" ]
  }  
}

output {
  if [type] == "beats"{
    elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{+YYYY.MM.dd}-container.api" 
      document_type => "%{[@metadata][type]}" 
      user => "elastic"
      password => "secret"
    }
  }
}

2）我测试了我的神交与调试器，你见下文

3）这是什么logstash写入elasticsearch

  {
    "_index": "2019.01.28-container.api",
    "_type": "doc",
    "_id": "pZctlWgBojxJzDZGWqZz",
    "_score": 1,
    "_source": {
      "type": "beats",
      "level": "Debug",
      "@timestamp": "2019-01-28T15:56:41.295Z",
      "msg": [
        "Hosting starting",
        "exception"
      ],
      "@version": "1",
      "logtime": [
        "2019-01-28 15:23:12.911 +03:00",
        "level"
      ],
      "message": "[2019-01-28 15:23:12.911 +03:00] [Debug] [Hosting starting] exception 2",
      "exception": "exception 2",
      "input": {
        "type": "log"
      }
    }
  }

4）我想看到的是

  {
    "_index": "2019.01.28-container.api",
    "_type": "doc",
    "_id": "pZctlWgBojxJzDZGWqZz",
    "_score": 1,
    "_source": {
      "type": "beats",
      "level": "Debug",
      "@timestamp": "2019-01-28T15:56:41.295Z",
      "msg": "Hosting starting",
      "logtime": "2019-01-28 15:23:12.911 +03:00",
      "message": "2019-01-28 15:23:12.911 +03:00 Debug Hosting starting [exception 2]",
      "exception": "exception 2"
    }
  }

Answer 1

问题是

mutate {
    add_field => [ "logtime", "level", "msg", "exception" ]
}

要添加已经由神交过滤器产生的场，老毛病又犯了也没用，只会改变已经存在的领域在阵列中，并添加到阵列的新的价值，因为mutate.addField使用散列，它会加重现场logtime值level和田野msg值exception。

Answer 2

mutate {
    add_field => [ "logtime", "level", "msg", "exception" ]
}

这是一样的：

mutate {
        add_field => { 
              "logtime" => "level" 
              "msg" => "exception" 
        }
   }

这就是为什么数组存在，并且具有多个值。既然你定义的神交模式中的变量名，您不必再指定。因此，作为baudsp说，你可以删除这个“加场”。