logstash 子(二级)字段过滤

logstash的数据源为json,
部分数据

"level" => {
       "levelStr" => "ERROR",
       "level" => 40000
},
"type" => "community",

一、用某个字段作为过滤条件

filter {
    if [type] != "community"{
        drop {}
    }
}

二、用某个二级字段作为过滤条件

filter {
    if [level][levelStr] != "ERROR"{
        drop {}
    }
}

参考:
https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474

猜你喜欢

转载自blog.51cto.com/4988084/2118214