logstash - 動態字段名稱

我的Logstash配置中的動態字段名稱有問題。這是我測試的配置： logstash - 動態字段名稱

input { 
generator { 
    lines => [ "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43", 
       "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version" ] 
    count => 7 
} 
} 
filter { 
    grok { 
    match => [ "message", "%{SYSLOGBASE} %{WORD:log}.*" ] 
    } 

     if "Starting" in [log] { 
     metrics { 
      meter => [ "%{logsource}.%{log}" ] 
      add_tag => [ "metric" ] 
      add_field => { "server" => "%{logsource}" 
         "bad" => "true" } 
      clear_interval => 5 
       } 
     } 
} 
output { 
     stdout { codec => rubydebug } 
}

，這裏是我的輸出：（剛剛結束輸出）

{ 
     "message" => "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43", 
     "@version" => "1", 
    "@timestamp" => "2016-06-07T07:37:50.138Z", 
      "host" => "logstash.test.lan", 
     "sequence" => 6, 
    "timestamp" => "May 15 13:42:55", 
    "logsource" => "test", 
     "program" => "puppet-agent", 
      "pid" => "3551", 
      "log" => "Finished" 
} 
{ 
     "message" => "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version", 
     "@version" => "1", 
    "@timestamp" => "2016-06-07T07:37:50.138Z", 
      "host" => "logstash.test.lan", 
     "sequence" => 6, 
    "timestamp" => "May 16 14:57:07", 
    "logsource" => "test", 
     "program" => "puppet-agent", 
      "pid" => "3551", 
      "log" => "Starting" 
} 
{ 
     "@version" => "1", 
    "@timestamp" => "2016-06-07T07:37:50.288Z", 
     "message" => "Counting: 7", 
     "logstash.Starting" => { 
      "count" => 7, 
     "rate_1m" => 0.0, 
     "rate_5m" => 0.0, 
     "rate_15m" => 0.0 
    }, 
     "server" => "%{logsource}", 
      "bad" => "true", 
      "tags" => [ 
     [0] "metric" 
    ] 
}

爲什麼領域服務器鴕鳥政策有logstash作爲值從輸入日誌？ ％{logsource}適用於米選項，那麼爲什麼不爲add_field？ Thx尋求幫助。

來源

2016-06-07 Rohlik

當收到日誌事件時，將從內容中提取SYSLOGBASE信息。這是定義％{logsource}值的位置。如果該事件不是來自包含SYSLOGBASE信息的日誌條目，則日誌源將是未定義的。

當您收到開始消息時，logsource將在範圍內定義並添加到消息中。

度量插件每隔一個間隔生成一條新消息。此消息是從頭開始生成的，因此它不具有logsource或任何其他通常從單個日誌條目中獲取的值。

來源

2016-06-15 18:38:48

是否可以做一些解決方法，以將動態數據從原始日誌添加到度量標準字段？ – Rohlik

不依據文檔。也許是作者的增強請求或問題... https://github.com/logstash-plugins/logstash-filter-metrics/issues –

logstash - 動態字段名稱

回答

相關問題