ELK日志回填问题

filter {

  json {

    source => "message"

  }

  ruby {

        code => "require 'digest/md5';event.set('[@metadata][computed_id]',Digest::MD5.hexdigest(event.get('message') + event.get('type') + event.get('source')))"

  }

  ...

}

output {

    elasticsearch {

      index => "accesslog-%{+YYYY.MM.dd}"

      flush_size => 60000

      document_id => "%{[@metadata][computed_id]}"

      idle_flush_time => 10

   }

}