在 Mapping 里面,将 dynamic 参数设置成 strict 可以拒绝索引包含未知字段的文档。 此条 Tips 由 medcl 贡献。

logstash过滤内容格式问题

Logstash | 作者 shitangjiejie | 发布于2022年09月19日 | 阅读数:1718

用logstash处理数据,源数据如下:
Vendor daemon status (on license-sever4):

snpslmd: UP v11.16.4
Feature usage info:

Users of SSS: (Total of 1 license issued; Total of 0 licenses in use)

Users of ACS: (Total of 8 licenses issued; Total of 0 licenses in use)

Users of Advanced_CDC: (Total of 2 licenses issued; Total of 0 licenses in use)

Users of BOA-BRT: (Total of 8 licenses issued; Total of 0 licenses in use)

Users of BasePolicySO: (Total of 1 license issued; Total of 0 licenses in use)

Users of CTV-Interface: (Total of 1 license issued; Total of 0 licenses in use)

Users of DC-Expert: (Total of 8 licenses issued; Total of 0 licenses in use)
logstash处理如下:
match => {
"message" => [
"(?m)(?<feat_name>%{LICNAME}): \(Total of %{NUMBER:[feature][total]} licenses? issued; Total of %{NUMBER:[feature][used]} licenses? in use\)"
]
}
但是处理过后在kibana上显示,会将所有的行归到一个message里去,如下图:
 
实际上想要的效果是一行一个message,请问该如何处理
微信图片_20220919152711.jpg
已邀请:

要回复问题请先登录注册