方法一:使用grok插件
1. d:/usr2/local/etc/logstash/pipeline1目錄下logstash.conf配置檔案
input {
stdin { }
}
filter {
grok {
# 比對路徑 /usr/share/filebeat/log/apps/butler/filebeat5.log中的butler
match => {message => "^/%{DATA}/%{DATA}/%{DATA}/%{DATA}/%{DATA}/%{DATA:path}/%{DATA}"}
}
}
output {
stdout { codec => rubydebug }
}
2. 啟動腳本
docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0
3. 控制台輸入内容,檢視結果
/usr/share/filebeat/log/apps/butler/filebeat2.log
方法二:使用ruby、mutate插件
1. logstash.conf配置檔案修改為
input {
stdin { }
}
filter {
ruby {
code => '
event.set("components", event.get("message").split("/"))
'
}
if [components][6] {
mutate {
add_field => {"path1" => "%{[components][6]}"}
remove_field => [components]
}
}
}
output {
stdout { codec => rubydebug }
}
2. 啟動腳本
docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0
3. 控制台輸入内容,檢視結果
/usr/share/filebeat/log/apps/butler/filebeat2.log
方法三:使用ruby插件
1. logstash.conf配置檔案修改為
input {
stdin { }
}
filter {
ruby {
code => '
event.set("path2", event.get("message").split("/")[-2])
'
}
}
output {
stdout { codec => rubydebug }
}
2. 啟動腳本
docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0
3. 控制台輸入内容,檢視結果
/usr/share/filebeat/log/apps/butler/filebeat2.log