浏览代码

dsfsadfasdfsdfasdf

yangxg 4 年之前
父节点
当前提交
e6b9c0373a
共有 1 个文件被更改,包括 2 次插入1 次删除
  1. 2 1
      deploy-tmp-logstash.yaml

+ 2 - 1
deploy-tmp-logstash.yaml

@@ -16,8 +16,9 @@ data:
     }
     
     filter {
+      mutate { remove_field => [ "[input][type]", "[prospector][type]", "[beat][name]", "[beat][hostname]", "source", "_score"  ] }
       grok{
-          match => {"message" => "(?m)^\[%{DATA:logdate}\] \[%{WORD:thread_trace_id}*\] \[%{WORD:biz_id}*\] \[%{WORD:uid}*\] \[%{WORD:udid}*\] \[%{LOGLEVEL:level}%{SPACE}*\] \[%{DATA:threadName}\] \[%{DATA:loggerName}\] \[%{DATA:method_line}\] - %{GREEDYDATA:msg}"}
+          match => {"message" => "(?m)^\[%{DATA:logdate}\] \[%{WORD:thread_trace_id}*\] \[%{WORD:biz_id}*\] \[%{NUMBER:uid}*\] \[%{WORD:udid}*\] \[%{LOGLEVEL:level}%{SPACE}*\] \[%{DATA:threadName}\] \[%{DATA:loggerName}\] \[%{DATA:method_line}\] - %{GREEDYDATA:msg}"}
       }
       date {
           match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]