你可以的,加油

logstash-7.x版本split问题

Logstash | 作者 yvhk635241 | 发布于2020年08月07日 | 阅读数:1968

{
"_index": "nginx-2020.08",
"_type": "_doc",
"_id": "vPY5w3MBb6nkHAxsYFvh",
"_version": 1,
"_score": null,
"_source": {
"log": {
"file": {
"path": "/opt/log/nginx/api-titan.hgame.com.log"
},
"offset": 5257642
},
"@version": "1",
"ecs": {
"version": "1.1.0"
},
"tags": [
"nginx",
"beats_input_codec_plain_applied",
"_mutate_error"
],
"@timestamp": "2020-08-06T10:03:03.247Z",
"message": "106.12.80.117 - - [06/Aug/2020:18:03:02 +0800] \"GET /openapi/v1/gameconf?_time=1596708182&project_name=%E4%BC%A0%E5%A5%87%E4%B8%96%E7%95%8C&app_name=server&zone_name=hf HTTP/1.1\" 200 40250 \"-\" \"Python-urllib/2.7\"",
"host": {
"name": "HD-BDSZ-OPS-WEB01"
}
},
"fields": {
"@timestamp": [
"2020-08-06T10:03:03.247Z"
]
},
"sort": [
1596708183247
]
}
上面是上报的数据,我想对log.file.path按 / 进行split切割,下面是我的配置
mutate {
split => ["log.file.path" ,"/" ]
#add_field => { "short_name" => "%{[path][2]}" }
}
logstash的日志在debug模式下有个错误提示
Can't split something that isn't a string {:field=>"log", :value=>{"offset"=>259050, "file"=>{"path"=>"/opt/log/nginx/api-monitor.hgame.com.log"}}}
大佬们帮忙看下这个要怎么解决呢
已邀请:

要回复问题请先登录注册