Logstash重命名特定字段？

Question

我有慢日誌是這樣的...

[2017-01-13 14:37:48,943][DEBUG][index.search.slowlog.query] [Spectra] [test][4] took[50micros], took_millis[0], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], 
[2017-01-13 12:58:09,844][WARN ][index.search.slowlog.query] [Spectra] [testindex-stats][1] took[16.2ms], took_millis[16], types[], stats[], search_type[QUERY_THEN_FETCH], 

我需要重命名就把[50micros]到了[50毫秒]在所有slowlogs。我如何能夠使用logstash實現這一點？

Answer 1

它好工作與GSUB過濾

mutate { 
    gsub => [ 

     "TOOK", "micros", "ms" 
    ] 
}