Browse Source

脚本部署

yangxg 3 years ago
parent
commit
d3b2371362
1 changed files with 1 additions and 1 deletions
  1. 1 1
      deploy-tmp-logstash.yaml

+ 1 - 1
deploy-tmp-logstash.yaml

@@ -23,7 +23,7 @@ data:
     }
     
     filter {
-      mutate { remove_field => [ "[input][type]", "[prospector][type]", "[beat][name]", "[beat][hostname]", "source", "_score" ] }
+      mutate { remove_field => [ "[input][type]", "[prospector][type]", "[beat][name]", "[beat][hostname]", "source", "_score", "@version", "_id", "[agent][type]", "[agent][id]", "[agent][name]", "[agent][version]", "[agent][ephemeral_id]", "[ecs][version]" ]}
       grok{
           match => {"message" => "(?m)^\[%{DATA:logdate}\] \[%{WORD:biz_id}*\] \[%{NUMBER:uid}*\] \[%{WORD:udid}*\] \[%{LOGLEVEL:level}%{SPACE}*\] \[%{DATA:threadName}\] \[%{DATA:loggerName}\] \[%{DATA:method_line}\] - %{GREEDYDATA:message}"}
           overwrite => ["message"]