请教大家,由logstash吐到elasticsearch,然后通过kibana查看对应信息。计划生成基于某字段平均数的曲线图,但发现分解的所有字段都是字符串,如何调整。谢谢
其中logstash的配置:
input {
redis {
host => "172.23.11.100"
port => 6379
key => "filebeat"
type => "filebeat"
data_type => "list"
}
}
filter {
if [type] == "monitor_access_log" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\|%{LOGLEVEL:level}\|%{WORD:filename}\|%{WORD:method}\|%{URIPATHPARAM:request}\|(?:HTTP/%{NUMBER:http_version})\|%{IP:client}\|%{INT:http_status_code}\|%{NUMBER:duration}\|(?<reserve1>([\s\S]*))\|(?<reserve2>([\s\S]*))\|(?<reserve3>([\s\S]*))"
}
}
}
}
output {
if [type] == "monitor_access_log" {
elasticsearch {
hosts => ["172.23.11.136:9200","172.23.11.137:9200","172.23.11.138:9200"]
index => "omp-monitor-access-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}
}
其中logstash的配置:
input {
redis {
host => "172.23.11.100"
port => 6379
key => "filebeat"
type => "filebeat"
data_type => "list"
}
}
filter {
if [type] == "monitor_access_log" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\|%{LOGLEVEL:level}\|%{WORD:filename}\|%{WORD:method}\|%{URIPATHPARAM:request}\|(?:HTTP/%{NUMBER:http_version})\|%{IP:client}\|%{INT:http_status_code}\|%{NUMBER:duration}\|(?<reserve1>([\s\S]*))\|(?<reserve2>([\s\S]*))\|(?<reserve3>([\s\S]*))"
}
}
}
}
output {
if [type] == "monitor_access_log" {
elasticsearch {
hosts => ["172.23.11.136:9200","172.23.11.137:9200","172.23.11.138:9200"]
index => "omp-monitor-access-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}
}
4 个回复
strglee
赞同来自:
lomonitor_access_log.json内容像这样:
Loading Zhang
赞同来自:
Chip
赞同来自:
lunatictwo
赞同来自: