logstash 字段类型转换后需要刷新-白红宇

logstash 字段类型转换后需要刷新

阅读量：5085 次

发布时间：2019-06-13

本文共 1201 字，大约阅读时间需要 4 分钟。

filter {    grok {        match => [             "message" , "\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
    
     (\S+))\?.*\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",              "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
     
      (\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",             "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?
      
       (\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+\-\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}"        ]    }           mutate {                        convert => [ "request_time", "float"]                       add_field =>["response_time","%{request_time}"]                        remove_field =>["request_time"]                                        }   date {        match => ["time", "dd/MMM/yyyy:HH:mm:ss Z"]    }     }