CentOS 7.6 部署ELK日志分析系统步骤(4)

index.conf
filter {
    mutate {
        add_field => { "spstr" => "%{[log][file][path]}" }
    }
        mutate {
        split => ["spstr" , "/"]
        # save the last element of the array as the api_method.
        add_field => ["src", "%{[spstr][-1]}" ]
        }
        mutate{
    remove_field => [ "friends", "ecs", "agent" , "spstr" ]
    }
}

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/74a3530b6ad41bc74ffb3b8a6b3fe632.html