Logstash学习之路（三）Logstash处理时区、类型转换、删除字段的案例配置

#输入
input {
 file {
        path => ["文件路径"]
#自定义类型
        type => "自定义"
       start_position => "beginning"
    }
}

#过滤器
filter{
#去除换行符
mutate{
gsub => [ "message", "\r", "" ]
}

#逗号分割
mutate {
  split => ["message",","]
}

#分割后，字段命名与赋值
mutate{
                add_field =>   {
                                        "id" => "%{[message][0]}"
"cc" => "%{[message][5]}"
"bcc" => "%{[message][6]}"
"from_user" => "%{[message][7]}"
                                        "size" => "%{[message][8]}"
"attachments" => "%{[message][9]}"
"content" => "%{[message][10]}"
                     }
               }

#字段里的日期识别，以及时区转换，生成date
      date {
            match => [ "mydate", "MM/dd/yyyy HH:mm:ss" ]
                       target => "date"
  locale => "en"
  timezone => "+00:00"
input {
        file {
                path => ["文件路径"]
                #自定义类型
                type => "自定义"
                start_position => "beginning"
}       

#过滤器
filter{
        #去除换行符
        mutate{
                gsub => [ "message", "\r", "" ]

        #逗号分割
                split => ["message",","]
        }       

        #分割后，字段命名与赋值
        mutate{
                        "id" => "%{[message][0]}"
                        "user" => "%{[message][2]}"
                        "pc" => "%{[message][3]}"
                        "cc" => "%{[message][5]}"
                        "bcc" => "%{[message][6]}"
                        "from_user" => "%{[message][7]}"
                        "attachments" => "%{[message][9]}"
                        "content" => "%{[message][10]}"
               }
       }       

        #字段里的日期识别，以及时区转换，生成date
        date {
                 match => [ "mydate", "MM/dd/yyyy HH:mm:ss" ]
                 target => "date"
                timezone => "+00:00"
        }       

        #删除无用字段
        mutate {
                remove_field => "message"
                remove_field => "mydate"
                remove_field => "@version"
                remove_field => "host"
                remove_field => "path"
        }
        #将两个字段转换为整型
        mutate{
                convert => { "size" => "integer" }
                convert => { "attachments" => "integer" }
        }
}       

#输出，输出目标为es
output {
        #stdout { codec => rubydebug }
        elasticsearch {
        #目标主机
        host => ["目标主机1","目标主机2"]
        #协议类型
        protocol => "http"
        #索引名
        index =>"自定义"
        #type
        document_type=>"自定义" }
}