你的浏览器禁用了JavaScript, 请开启后刷新浏览器获得更好的体验!
输入关键字进行搜索
搜索:
没有找到相关结果
bellengao - 博客: https://www.jianshu.com/u/e0088e3e2127
赞同来自:
Lotus - 90后
menglinjie
filter { aggregate { task_id => "%{id}" code => " map['id'] = event.get('id') map['register_name'] = event.get('register_name') map['mobile'] = event.get('mobile') map['avatar'] = event.get('avatar') map['pet_list'] ||=[] map['pets'] ||=[] if (event.get('pet_id') != nil) if !(map['pet_list'].include? event.get('pet_id')) map['pet_list'] << event.get('pet_id') map['pets'] << { 'pet_id' => event.get('pet_id'), 'name' => event.get('name'), 'images' => event.get('images'), 'breed_id' => event.get('breed_id'), 'breed_name' => event.get('breed_name'), 'birthday' => event.get('birthday') } end end event.cancel() " push_previous_map_as_event => true timeout => 5 } json { source => "message" remove_field => ["message"] #remove_field => ["message", "type", "@timestamp", "@version"] } mutate { #将不需要的JSON字段过滤,且不会被存入 ES 中 remove_field => ["tags", "@timestamp", "@version"] } }
dxt
要回复问题请先登录或注册
90后
4 个回复
bellengao - 博客: https://www.jianshu.com/u/e0088e3e2127
赞同来自:
Lotus - 90后
赞同来自:
nested查询 报错信息如下,究其原因 还是因为 tbl 这个主字段设计是nested类型,但并不是,如下图所示:
menglinjie
赞同来自:
不过要注意一个问题,配置中需要指定线程数
pipeline.workers=1 否则聚合出来的子数组对象是不准确的,会丢失一些数据。
dxt
赞同来自: