1.仅支持int 和 float
Optionally you can add a data type conversion to your grok pattern. By default all semantics are saved as strings. If you wish to convert a semantic’s data type, for example change a string to an integer then suffix it with the target data type. For example %{NUMBER:num:int}
which converts the num
semantic from a string to an integer. Currently the only supported conversions are int
and float
.
2.支持'string,integer,float,boolean'
filter {
csv {
separator => ","
columns => ["Date","Open","High","Low","Close","Volume","Adj Close"]
}
mutate {convert => ["High", "float"]}
mutate {convert => ["Open", "float"]}
mutate {convert => ["Low", "float"]}
mutate {convert => ["Close", "float"]}
mutate {convert => ["Volume", "float"]}
}
3.将日志中的时间戳设置为默认的 @timestamp(首先抽取到strlogtime中,然后放入@timestamp)
if [type] == "hailianglog" {
grok {
patterns_dir => "/etc/logstash/patterns"
match => {"message" => "%{YEARDATESTAMP:strlogtime}%{SPACE}%{JAVAFILEINFO:logpackage}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:package}%{SPACE}%{MESSAGE:msg}"}
}
date { match => ["strlogtime", "yyyy-MM-dd HH:mm:ss.SSS"] target => "@timestamp" }
}
注:YEARDATESTAMP %{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}[- ]%{TIME}