logstash收集IIS日志转发给ES,默认response为text类型,如何转换为数值型
Logstash | 作者 liuzhanjiang | 发布于2019年07月13日 | 阅读数:2284
本人小白一枚,最近公司领导让研究ELK的使用,目前环境已经搭建OK,数据可以从IIS日志通过filebeat收集并转发给logstash,但是日志里的response默认转给ES为TEXT类型,logstash增加了convert,重新接收数据后,没有该字段值,请大神帮忙指导。
logstash.conf如下:
input {
beats {
port => "5044"
}
}
filter {
grok {
match => { "message" => "%{IIS_LOG}" }
}
date {
match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
mutate {
convert => { "sc_status" => "integer" }
}
geoip { source => "c_ip" }
output {
if [tags] and "_grokparsefailure" in [tags] {
elasticsearch {
hosts => ["localhost:9200"]
index => "failure"
document_type => "iislog"
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
index => "iis-log"
document_type => "iislog"
}
}
stdout { codec => rubydebug }
}
logstash.conf如下:
input {
beats {
port => "5044"
}
}
filter {
grok {
match => { "message" => "%{IIS_LOG}" }
}
date {
match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
mutate {
convert => { "sc_status" => "integer" }
}
geoip { source => "c_ip" }
output {
if [tags] and "_grokparsefailure" in [tags] {
elasticsearch {
hosts => ["localhost:9200"]
index => "failure"
document_type => "iislog"
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
index => "iis-log"
document_type => "iislog"
}
}
stdout { codec => rubydebug }
}
3 个回复
liuzhanjiang - 80
赞同来自:
1.kinana里的IIS-log索引刷新后,显示是NUMBER型,在discover里看不到字段,
2.删除索引后,重新创建后,显示出来了。
zqc0512 - andy zhou
赞同来自:
chenl - 。。。
赞同来自: