行动是治愈恐惧的良药,而犹豫、拖延将不断滋养恐惧。

Filebeat默认nginx模块添加了request_time,请问怎么将该字段修改为number类型?

Beats | 作者 melody65 | 发布于2020年01月06日 | 阅读数:663

下面是filebeat-7.5.1/module/nginx/access/ingest/default.json的配置
{
"description": "Pipeline for parsing Nginx access logs. Requires the geoip and user_agent plugins.",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"\"\"?%{IP_LIST:nginx.access.remote_ip_list}\"\"%{NUMBER:nginx.access.request_time}\"\"%{DATA:nginx.access.upstream_response_time}\"\"%{DATA:nginx.access.user_name}\"\"\\[%{HTTPDATE:nginx.access.time}\\]\"\"%{DATA:nginx.access.upstream_addr}\"\"%{GREEDYDATA:nginx.access.info}\"\"%{NUMBER:nginx.access.response_code}\"\"%{NUMBER:nginx.access.body_sent.bytes}\"\"%{DATA:nginx.access.request_body}\"\"%{DATA:nginx.access.referrer}\"\"%{DATA:nginx.access.agent}\"\"%{DATA:nginx.access.xff}\""
],
"pattern_definitions": {
"IP_LIST": "%{IP}(\"?,?\\s*%{IP})*"
},
"ignore_missing": true
}
},

下面是field.yml添加的配置
- name: xff
type: group
description: >
http_x_forwarded_for.
- name: request_time
type: group
description: >
request_time 请求时间.
- name: upstream_response_time
type: group
description: >
upstream_response_time 后端响应时间.
- name: upstream_addr
type: group
description: >
upstream_addr 后端地址.
- name: request_body
type: group
description: >
request_body 请求主体.

已邀请:

liuxing6

赞同来自:

默认配置中%{NUMBER:nginx.access.request_time}
本来不就是number类型吗?
 

要回复问题请先登录注册